Skip to content
Critical Authentication Flaw in SmsForwarder Remote Control API

Critical Authentication Flaw in SmsForwarder Remote Control API

First seen 15 Oct 2026, 01:38 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 15, 2026 at 01:39 UTC
  • •SmsForwarder versions up to 3.5.0 are vulnerable due to missing authentication.
  • •The default security mode allows unauthenticated access to sensitive operations.
  • •No patch has been released, posing a significant risk to users.

SmsForwarder versions up to 3.5.0 have a critical vulnerability due to missing authentication in its HTTP server remote control API. The default security mode is set to '0', allowing unauthenticated access to sensitive operations like SMS forwarding and location tracking. This vulnerability affects users who have enabled the HTTP server feature without configuring a signing key. The flaw was confirmed by multiple sources on October 15, 2026, and is categorized under CWE-306 for missing authentication. No patch has been reported yet, and the vulnerability poses a significant risk to user data and privacy. Security professionals are urged to disable the HTTP server feature until a fix is available.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-15
Vulnerability disclosed
SmsForwarder versions up to 3.5.0 were found to have a critical authentication flaw in the HTTP server API.
hackmd.io
2026-10-15
Vulnerability advisory published
Vulncheck confirmed the missing authentication issue in SmsForwarder and categorized it under CWE-306.
www.vulncheck.com

More articles in this cluster (2)

Extracted Entities (2)

1 / 3

Common questions

Which versions are affected?
SmsForwarder versions up to and including 3.5.0 are affected by this vulnerability.
Is there a patch available?
No patch has been released as of now; users are advised to disable the HTTP server feature.
What actions should I take?
Disable the HTTP server feature in SmsForwarder to mitigate the risk of unauthorized access.