That changed with the discovery of a critical vulnerability in the chipset (powering the Helio G96 and G99). Known colloquially in underground forums and among hardware hackers as the "MT6789 Auth Bypass," this exploit has reopened a door that MediaTek tried to weld shut.
For consumers, the message is clear: if you own an MT6789 device (Helio G96/G99), assume that physical security is compromised. Full disk encryption and strong lock screens remain your best defense, but against an attacker with USB access and this bypass, no amount of software security will protect your data. mt6789 auth bypass
In the world of mobile forensics, data recovery, and repair, few names carry as much weight—or as much frustration—as MediaTek’s bootrom and Preloader authentication mechanisms. For years, MediaTek chipsets have been fortified with SLA (Secure Layer Authentication) and DAA (Download Agent Authentication), preventing unauthorized access, unbricking, and forensic extraction. That changed with the discovery of a critical
As of mid-2026, no public fix exists for the MT6789. The exploit is stable, documented, and integrated into mainstream forensic tools. The silicon vault has been unlocked – and the key is now common knowledge. This article is for educational and research purposes. Always obtain explicit written permission before testing security on any device you do not own. Full disk encryption and strong lock screens remain
For the industry, it is a cold reminder that BootROM code must be formally verified with zero-tolerance for race conditions. One mistaken flag in a USB control transfer can undo years of security investment.
MTK Flash/Exploit Client V2.0 Preloader - CPU: MT6789, SLA: Locked Sending Bypass Payload (wIndex=0xBAAD)... Bypass OK, Authentication Disabled. DA sent successfully. Reading flash ... | Chipset | Vulnerability | Patchable | SLA/DAA Bypass | Notes | |--------------|----------------|-----------|----------------|-------| | MT6580 | Legacy, no auth| N/A | None needed | No SLA | | MT6739 | None (hardened)| Fixed in ROM | No | Secure | | MT6765 (P65) | SLA bypass via USB overflow | Yes (Preloader update) | Partial | Requires specific DA | | MT6789 | BootROM race condition | No (mask ROM) | Full | Permanent exploit | | MT6833 (D700)| None | N/A | No | Revised BootROM |