# Unauthenticated local IPC and loopback APIs

Local daemons, XPC/Mach services, or loopback HTTP servers accepting any client without auth, entitlement, or Host checks

_Area: Memory corruption and native code. Seen in 8 disclosed reports; 5 confirmed bounties, median $10,000, range $560-$29,500; latest 2026-07-30. Updated 2026-10-23._

## How it works
A privileged local service assumes only trusted software can reach it. That assumption breaks when the transport is reachable by any local process (or by browser JS via loopback) and the service never verifies who is calling. The service then acts on behalf of an unauthenticated caller: reading protected files, launching URLs, loading modules, or reconfiguring the daemon. The root cause is a missing or too-weak caller-identity check, not a memory bug.

## Where it shows up
- XPC/Mach listener delegates that return YES for every client, or never check entitlements/code signing [E7](https://bugbountylibrary.com/r/blog%3Ajhftss-github-io-macos-auhelperservice-full-tcc-bypass.md)[E8](https://bugbountylibrary.com/r/blog%3Arambo-codes-posts-2022-03-15-how-a-macos-bug-could-have-allowed-for-a-serious-phishing-attack-against-users.md)
- Client checks that verify only Team ID or signing certificate, not the specific binary identity or hardened runtime [E4](https://bugbountylibrary.com/r/h1%3A980876.md)[E6](https://bugbountylibrary.com/r/h1%3A750118.md)
- Services holding powerful entitlements (Full Disk Access, TCC) but open to all local callers [E7](https://bugbountylibrary.com/r/blog%3Ajhftss-github-io-macos-auhelperservice-full-tcc-bypass.md)
- Loopback TCP HTTP servers (127.0.0.1:port) without Host header allowlists, reachable via DNS rebinding [E2](https://bugbountylibrary.com/r/blog%3Aemily-id-au-tailscale.md)
- Compat/reimplementation layers that read an auth cookie but never compare it, then set authenticated=true [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md)
- BLE GATT services streaming user audio to any subscriber without permission checks [E1](https://bugbountylibrary.com/r/blog%3Arambo-codes-posts-2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop.md)

## How to review
For each local service, find the exact identity check on the connecting process and confirm it is positive, not merely present. XPC/Mach: require an audit-token or code-signing check on the specific binary (bundle ID plus signature plus hardened runtime), not just Team ID or certificate [E4](https://bugbountylibrary.com/r/h1%3A980876.md)[E6](https://bugbountylibrary.com/r/h1%3A750118.md). Loopback HTTP: require a strict Host/Origin allowlist, since loopback TCP is reachable by browser JS [E2](https://bugbountylibrary.com/r/blog%3Aemily-id-au-tailscale.md). The invariant: every privileged routine must be reachable only by a caller whose identity has been positively verified, and no credential may be derivable from locally exposed data. Enumerate every protocol routine, not just the entry point [E7](https://bugbountylibrary.com/r/blog%3Ajhftss-github-io-macos-auhelperservice-full-tcc-bypass.md). Trace server-controlled URL/path fields into OS open handlers and module loaders [E2](https://bugbountylibrary.com/r/blog%3Aemily-id-au-tailscale.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md).

## Variants seen
- Open XPC delegate with FDA entitlement enabling TCC bypass [E7](https://bugbountylibrary.com/r/blog%3Ajhftss-github-io-macos-auhelperservice-full-tcc-bypass.md)
- Unauthenticated Mach service enabling phishing UI [E8](https://bugbountylibrary.com/r/blog%3Arambo-codes-posts-2022-03-15-how-a-macos-bug-could-have-allowed-for-a-serious-phishing-attack-against-users.md)
- Team-ID-only or cert-only XPC check bypassed via dylib injection into an older signed binary [E4](https://bugbountylibrary.com/r/h1%3A980876.md)[E6](https://bugbountylibrary.com/r/h1%3A750118.md)
- Loopback HTTP without Host validation plus DNS rebinding [E2](https://bugbountylibrary.com/r/blog%3Aemily-id-au-tailscale.md)
- Auth cookie length-checked but value ignored, plus default module loading [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md)
- BLE service bypassing microphone permission [E1](https://bugbountylibrary.com/r/blog%3Arambo-codes-posts-2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop.md)

## Impact and severity
Ranged from credential phishing [E8](https://bugbountylibrary.com/r/blog%3Arambo-codes-posts-2022-03-15-how-a-macos-bug-could-have-allowed-for-a-serious-phishing-attack-against-users.md) and AV bypass [E4](https://bugbountylibrary.com/r/h1%3A980876.md) to full TCC bypass [E7](https://bugbountylibrary.com/r/blog%3Ajhftss-github-io-macos-auhelperservice-full-tcc-bypass.md), sandbox escape [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md), and RCE [E2](https://bugbountylibrary.com/r/blog%3Aemily-id-au-tailscale.md). Severity rises when the service holds high entitlements, when the transport is reachable by sandboxed apps or browser JS, and when the check is weak-but-present (Team ID, certificate) rather than absent, since that invites false confidence.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Arambo-codes-posts-2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop.md
- E2: https://bugbountylibrary.com/r/blog%3Aemily-id-au-tailscale.md
- E3: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-pipewire-flatpak-linux-sandbox-escape-cve-2026-5674.md
- E4: https://bugbountylibrary.com/r/h1%3A980876.md
- E5: https://bugbountylibrary.com/r/h1%3A2437050.md
- E6: https://bugbountylibrary.com/r/h1%3A750118.md
- E7: https://bugbountylibrary.com/r/blog%3Ajhftss-github-io-macos-auhelperservice-full-tcc-bypass.md
- E8: https://bugbountylibrary.com/r/blog%3Arambo-codes-posts-2022-03-15-how-a-macos-bug-could-have-allowed-for-a-serious-phishing-attack-against-users.md