{"id":"CVE-2026-0073","aliases":["A-469080888","ASB-A-469080888","EUVD-2026-27041","GHSA-6hgp-j96h-rqw4"],"status":"published","title":"In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual...","description":"In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00541,"percentile":0.45746,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-303"],"published":"2026-05-01T00:00:00Z","modified":"2026-11-05T19:46:44Z","exploits":[{"source":"pocgithub","id":"SecTestAnnaQuinn/CVE-2026-0073-Android-adbd-authentication-bypass-POC","title":"SecTestAnnaQuinn/CVE-2026-0073-Android-adbd-authentication-bypass-POC","date":"2026-05-05","url":"https://github.com/SecTestAnnaQuinn/CVE-2026-0073-Android-adbd-authentication-bypass-POC"},{"source":"pocgithub","id":"novaek/CVE-2026-0073-Research","title":"novaek/CVE-2026-0073-Research","date":"2026-05-05","url":"https://github.com/novaek/CVE-2026-0073-Research"},{"source":"pocgithub","id":"MartinPSDev/CVE-2026-0073-Android-ADBD-bypass-POC","title":"MartinPSDev/CVE-2026-0073-Android-ADBD-bypass-POC","date":"2026-05-06","url":"https://github.com/MartinPSDev/CVE-2026-0073-Android-ADBD-bypass-POC"},{"source":"pocgithub","id":"adityatelange/poc-CVE-2026-0073","title":"adityatelange/poc-CVE-2026-0073","date":"2026-05-06","url":"https://github.com/adityatelange/poc-CVE-2026-0073"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-0073","title":"ashrafzaryouh/CVE-2026-0073","date":"2026-05-07","url":"https://github.com/ashrafzaryouh/CVE-2026-0073"},{"source":"pocgithub","id":"unnaim/adbHijacker","title":"unnaim/adbHijacker","date":"2026-05-07","url":"https://github.com/unnaim/adbHijacker"},{"source":"pocgithub","id":"xqi1337/CVE-2026-0073-Android-ADBD-bypass-POC","title":"xqi1337/CVE-2026-0073-Android-ADBD-bypass-POC","date":"2026-05-09","url":"https://github.com/xqi1337/CVE-2026-0073-Android-ADBD-bypass-POC"},{"source":"pocgithub","id":"xqi1337/poc-CVE-2026-0073","title":"xqi1337/poc-CVE-2026-0073","date":"2026-05-09","url":"https://github.com/xqi1337/poc-CVE-2026-0073"},{"source":"pocgithub","id":"tc4dy/CVE-2026-0073-PoC-Exploit","title":"tc4dy/CVE-2026-0073-PoC-Exploit","date":"2026-05-13","url":"https://github.com/tc4dy/CVE-2026-0073-PoC-Exploit"},{"source":"pocgithub","id":"0xbinder/CVE-2026-0073","title":"0xbinder/CVE-2026-0073","date":"2026-05-20","url":"https://github.com/0xbinder/CVE-2026-0073"},{"source":"pocgithub","id":"m00ddy/CVE-2026-0073-Android-client-TLS-auth-bypass","title":"m00ddy/CVE-2026-0073-Android-client-TLS-auth-bypass","date":"2026-05-25","url":"https://github.com/m00ddy/CVE-2026-0073-Android-client-TLS-auth-bypass"},{"source":"pocgithub","id":"fredevsec/CVE-2026-0073","title":"fredevsec/CVE-2026-0073","date":"2026-06-04","url":"https://github.com/fredevsec/CVE-2026-0073"},{"source":"pocgithub","id":"ctn-Qvo/CVE-2026-0073-Android-ADBD-bypass-POC_zh_CN","title":"ctn-Qvo/CVE-2026-0073-Android-ADBD-bypass-POC_zh_CN","date":"2026-06-27","url":"https://github.com/ctn-Qvo/CVE-2026-0073-Android-ADBD-bypass-POC_zh_CN"},{"source":"pocgithub","id":"aye468448-eng/CVE-2026-0073-Android-adbd-authentication-bypass","title":"aye468448-eng/CVE-2026-0073-Android-adbd-authentication-bypass","date":"2026-08-21","url":"https://github.com/aye468448-eng/CVE-2026-0073-Android-adbd-authentication-bypass"},{"source":"pocgithub","id":"naheeju/POC-CVE-2026-0073","title":"naheeju/POC-CVE-2026-0073","date":"2026-08-31","url":"https://github.com/naheeju/POC-CVE-2026-0073"},{"source":"pocgithub","id":"umarrehmansiddiqui/CVE-2026-0073","title":"umarrehmansiddiqui/CVE-2026-0073","date":"2026-10-25","url":"https://github.com/umarrehmansiddiqui/CVE-2026-0073"}],"fixes":[{"ecosystem":"Android","package":"platform/packages/modules/adb","fixed_in":["16-qpr2-next:2026-05-01","15:2026-05-01","16:2026-05-01","16-qpr2:2026-05-01","14:2026-05-01"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":"platform/packages/modules/adb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2-next:0"},{"fixed":"16-qpr2-next:2026-05-01"}]}],"versions":["16-qpr2-next"]},{"source":"osv","ecosystem":"Android","package":"platform/packages/modules/adb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-05-01"}]}],"versions":["15"]},{"source":"osv","ecosystem":"Android","package":"platform/packages/modules/adb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-05-01"}]}],"versions":["16"]},{"source":"osv","ecosystem":"Android","package":"platform/packages/modules/adb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-05-01"}]}],"versions":["16-qpr2"]},{"source":"osv","ecosystem":"Android","package":"platform/packages/modules/adb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-05-01"}]}],"versions":["14"]}],"products":[{"vendor":"google","product":"android"}],"references":[{"url":"https://source.android.com/docs/security/bulletin/2026/2026-05-01","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0073"},{"url":"https://github.com/advisories/GHSA-6hgp-j96h-rqw4"},{"url":"https://source.android.com/security/bulletin/2026-05-01","tags":["advisory"]},{"url":"https://android.googlesource.com/platform/packages/modules/adb/+/842d331f9e5fb10770a09379e19240daea057dba","tags":["fix"]}],"sources":{"cve":[{"id":"CVE-2026-0073","description":"In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-05-04T18:00:10.613Z","modified":"2026-05-05T03:56:34.252Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-303"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-27041","description":"In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-05-04T18:00:10Z","modified":"2026-05-05T03:56:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:05:17.068199Z"}],"ghsa":[{"id":"GHSA-6hgp-j96h-rqw4","title":"In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual...","description":"In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-05-04T18:30:31Z","modified":"2026-05-04T21:31:28Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-303"],"updated_at":"2026-11-02T15:07:54.707151Z"}],"nvd":[{"id":"CVE-2026-0073","description":"In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-05-04T18:16:26.013Z","modified":"2026-11-05T19:46:44.75Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-303"],"updated_at":"2026-11-05T21:56:41.057422Z"}],"osv":[{"id":"ASB-A-469080888","description":"In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2026-05-01T00:00:00Z","modified":"2026-11-10T17:02:23.040266809Z","updated_at":"2026-11-10T17:35:07.135383Z"}]}}