Vulnerability · Published Sep 2, 2025 · Assigned by VulDB

CVE-2025-9815alaneuler batteryKid NSXPCListener PrivilegeHelper.swift missing authentication

High 7.8

In plain English

A high-severity missing authentication in batteryKid from alaneuler. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.3%top 79.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in alaneuler batteryKid up to 2.1 on macOS. The affected element is an unknown function of the file PrivilegeHelper/PrivilegeHelper.swift of the component NSXPCListener. This manipulation causes missing authentication. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be exploited.

Affected products (as reported)

Vendor	Product	Versions
alaneuler	batteryKid	2.02.1

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-322142 | alaneuler batteryKid NSXPCListener PrivilegeHelper.swift missing authentication vdb-entry
VDB-322142 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #641358 | alaneuler batteryKid v2.1 Missing Authentication for Critical Function third-party-advisory
https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md related
https://github.com/SwayZGl1tZyyy/n-days/blob/main/batteryKid/README.md#proof-of-concepts exploit