Soroush IM Desktop App Authentication Bypass Vulnerability in Database Injection

An authentication bypass vulnerability has been identified in Soroush IM Desktop App version 0.17.0. This vulnerability allows local attackers to remove passcodes by injecting pre-encrypted database entries using a constant encryption key. Exploitation involves injecting malicious database records into the application's database files, which can unlock the client and grant access to all stored data, including chats, images, and files, without needing to know the original passcode.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling unauthorized access to the application's data and features.