Auth bypass in Nosleep

CVE-2026-19755

NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects NoSleep: 1.5.1.

Vulnerability class: Broken Access Control

Affected products

Nosleep — versions 1.5.1

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

help@fluidattacks.com (third-party-advisory)
help@fluidattacks.com (product)