Auth bypass in Airkeyboardapp Airkeyboard iOS App

CVE-2025-66555

AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.

Vulnerability class: Broken Authentication

Published 2025-12-04 · last modified 2026-06-17.

EPSS exploit prediction

EPSS: 0.007 (50.6th percentile), scored 2026-10-04.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000

Affected products

Airkeyboardapp Airkeyboard iOS App — versions 1.0.5

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

www.exploit-db.com/exploits/52333 (exploit)
airkeyboardapp.com (product, vendor-advisory)
apps.apple.com/us/app/air-keyboard/id6463187929 (product)
www.vulncheck.com/advisories/airkeyboard-ios-app-105-remote-input-injection (third-party-advisory)