CVE-2026-110618: SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated network attacker who can reach the AndServer HTTP server can invoke the affected remote-control APIs. No prior privileges or user interaction are required.
Are the affected APIs enabled by default?
Yes. The remote-control endpoints that allow reading SMS, call logs, and contacts; sending SMS; and exporting or overwriting configuration through the clone API are default-enabled.
What could an attacker do through the exposed API?
An attacker can read SMS messages, call logs, and contacts, send SMS messages, and export or overwrite the application's configuration using the clone API.