Auth bypass in Airkeyboardapp Airkeyboard iOS App

CVE-2025-66555

AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.

Vulnerability class: Broken Authentication

EPSS: 0.006 (46.5th percentile) — read the EPSS interpretation.

Affected products

Airkeyboardapp Airkeyboard Ios App — versions 1.0.5

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (product, vendor-advisory)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)