This vulnerability in the Android application Shelter, specifically versionCode 445, allows an attacker to register a custom authentication key. By forging the auth_key, the attacker can take over the binder service API and preference state of another user, effectively impersonating them inside the app. The flaw represents a serious authentication bypass and privilege escalation flaw, exposing sensitive data and enabling unauthorized manipulation of user-specific preferences.

The issue is confined to the Shelter application. VersionCode 445 is affected; no other vendors or products are listed in the CNA data.

The vulnerability has no published EPSS or KEV status, but its nature suggests that an attacker with local or remote access to the device could exploit it by registering a forged key and hijacking another user's service. The absence of mitigation in the app’s current release means the risk is considerable for users storing sensitive information within Shelter. Given the lack of exploitation data, the exact likelihood is unknown, but the impact is high if the flaw is exploited.