🔓 CVE-2026-0073: Android adbd Authentication Bypass

Weaponized Proof of Concept for the Wireless ADB TLS Auth Bypass vulnerability. Discovered by Barghest, Weaponized PoC by devtint.

📋 Overview

CVE-2026-0073 is a critical cryptographic logic failure in the Android Debug Bridge daemon (adbd) that grants an unauthenticated attacker on the same local network Zero-Click remote root access.

This repository contains:

• adb_tls_auth_bypass.py — Clean, standalone PoC for the STLS/TLS authentication bypass.
• main.py — Maximized exploitation framework with automated profiling, artifact extraction, and persistence injection.

The Cryptographic Flaw

The vulnerability exists within daemon/auth.cpp inside the adbd_tls_verify_cert() function. When a client connects via Wireless ADB (STLS path), a mutual TLS 1.3 handshake occurs. The device compares the client's public key against stored authorized keys using OpenSSL's EVP_PKEY_cmp().

// daemon/auth.cpp — The Vulnerable Logic
if (EVP_PKEY_cmp(stored_key, client_key)) {
    // EVP_PKEY_cmp returns:
    //   1  = keys match
    //   0  = keys differ
    //  -1  = type mismatch (RSA vs EC)  ← BUG: truthy in C++
    authorized = true;
}

• If the stored key is RSA and the client presents an EC P-256 key, EVP_PKEY_cmp() returns -1 (type mismatch).
• In C/C++, -1 evaluates to true.
• The adbd logic interprets this -1 as a perfect match.
• The device silently grants a root shell without ever waking the screen or prompting the victim.

⚠️ Critical: STLS vs AUTH — Port Requirements

This exploit only works on the Wireless Debugging STLS path, not the legacy adb tcpip path.

How to identify the correct port

1. On the target device: Settings → Developer Options → Wireless Debugging → ON
2. The IP address and randomized port are displayed on that screen (e.g., 192.168.1.34:38741)
3. This port changes every time Wireless Debugging is toggled or the device reconnects to Wi-Fi

Error: "Device responded with AUTH instead of STLS"

This means you are connecting to a legacy ADB TCP port (typically 5555). The legacy path uses the old RSA AUTH handshake — a completely different code path in adbd that is not affected by this CVE. You must connect to the Wireless Debugging port instead.

⚡ Maximized Capabilities

The framework (main.py) extends the core TLS bypass into a modular post-exploitation toolkit:

• 💻 Interactive Shell: Drops directly into a stable, persistent uid=0(root) pseudo-terminal.
• 🔍 Automated Profiling (--profile): Instantly fingerprints the target OS, security patch level, SELinux enforcement, and active routing tables for internal network pivoting.
• 📂 Artifact Extraction (--extract): Automatically exfiltrates highly sensitive system files (e.g., /data/misc/adb/adb_keys, /system/build.prop) directly over the bypass socket.
• 🔑 Stealth Persistence (--persist): Injects a rogue RSA public key into the target's authorized keys file. Once injected, the attacker retains permanent, fully authenticated access even if the CVE is later patched.

🏃 Usage

1. Install Dependencies:

   root@kitploit:~

   pip install cryptography
   

2. Locate Target: Find an Android device with Wireless Debugging enabled on your local subnet. Note the dynamic port from the device's Developer Options screen.

3. Execute the Exploit Framework:

   root@kitploit:~

   # Interactive Shell (Default)
   python main.py <IP> <PORT>
   
   # Single Command Execution
   python main.py <IP> <PORT> --cmd "id"
   
   # Automated System Profiling
   python main.py <IP> <PORT> --profile
   
   # Stealth Artifact Extraction
   python main.py <IP> <PORT> --extract
   
   # Inject Permanent Backdoor Key
   python main.py <IP> <PORT> --persist
   

4. Standalone PoC (minimal):

   root@kitploit:~

   python adb_tls_auth_bypass.py <IP> <PORT> --cmd "id; whoami"
   

🔧 Troubleshooting

🛡️ Mitigation

• Patch: Update to the May 2026 Android Security Bulletin (2026-05-01 or later).
• Disable Service: Keep Wireless Debugging turned off when not actively profiling an application.
• Key Rotation: Periodically "Revoke USB debugging authorizations" in Developer Options to purge legacy RSA keys from the device keystore.

⚖️ Legal Disclaimer

This repository is strictly for educational, red teaming, and authorized security testing purposes only. Unauthorized access to computer systems is illegal. The author assumes no liability for misuse of this information.