CVE-2025-66555 AirKeyboard iOS App 1.0.5 - Remote Input Injection
Unauthenticated attackers can inject arbitrary keystrokes into the victim's iOS device, enabling full remote input control and potential system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-66555?
CVE-2025-66555 is a high-severity missing authorization vulnerability in airkeyboardapp AirKeyboard iOS App, published on 4 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device in real-time without user interaction, resulting in full remote input control.
Weakness: CWE-306
Which versions are affected by CVE-2025-66555?
How do I fix CVE-2025-66555?
No fix has been published for CVE-2025-66555 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-66555 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66555 exists.
Sources
Also known as GHSA-5gq3-gp97-c3q6.