EUVD-2025-201279Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Unauthorized access to protected functionality, data, or administrative interfaces, potentially leading to full system compromise. |
| Exploit ScenarioDerived | An attacker manipulates authentication tokens, exploits logic flaws, or uses default credentials to bypass the login mechanism and access restricted areas. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.
Earlier versions of this analysis (1)
RemediationAI
Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Missing Authentication for Critical Function (CWE-306).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2Executive ViewAI
CVE-2025-66555 in AirKeyboard iOS App 1.0.5 allows remote attackers to gain unauthorized input control over affected iOS devices without authentication or user interaction. Organizations with employees using this app face immediate risk of credential theft, unauthorized actions, and data exfiltration. This vulnerability is actively exploited in the wild with public exploits available, and no vendor patch currently exists.
Immediately disable or uninstall AirKeyboard application across all managed devices via Mobile Device Management (MDM). Enforce app allowlisting to prevent reinstallation. Implement network segmentation to limit lateral movement if device compromise occurs. Enable MFA on all critical systems and monitor for unusual input patterns in audit logs. Consider restricting iOS device network access during incident investigation. Block known C2 infrastructure at network perimeter if identified.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC