Common Weakness Enumeration

CWE-939

Allowed

Improper Authorization in Handler for Custom URL Scheme

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

48 vulnerabilities reference this CWE, most recent first.

CVE-2026-12190 (GCVE-0-2026-12190)

Vulnerability from cvelistv5 – Published: 2026-06-14 22:45 – Updated: 2026-06-15 10:37
VLAI
Title
Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme
Summary
A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the component ai.mainfunc.genspark. The manipulation leads to improper authorization in handler for custom url scheme. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
4.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
5.3 (Medium)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 10:37 UTC
CWE
  • CWE-939 - Improper Authorization in Handler for Custom URL Scheme
  • CWE-285 - Improper Authorization
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3880 records in the last 180 days details
References
Impacted products
Vendor Product Version
Genspark AI Workspace App Affected: 2.8.4
    cpe:2.3:a:genspark:ai_workspace_app:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Actuator (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12190",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T10:37:20.935685Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T10:37:48.347Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:genspark:ai_workspace_app:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "ai.mainfunc.genspark"
          ],
          "product": "AI Workspace App",
          "vendor": "Genspark",
          "versions": [
            {
              "status": "affected",
              "version": "2.8.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Actuator (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the component ai.mainfunc.genspark. The manipulation leads to improper authorization in handler for custom url scheme. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4.3,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "Improper Authorization in Handler for Custom URL Scheme",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T22:45:07.816Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-370836 | Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/370836"
        },
        {
          "name": "VDB-370836 | CTI Indicators (IOB, IOC)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/370836/cti"
        },
        {
          "name": "CVE-2026-12190 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-12190"
        },
        {
          "name": "Submit #825558 | Genspark Genspark AI Workspace 2.8.4 (versionCode 28401) Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/825558"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/actuator/ai.mainfunc.genspark"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-14T08:43:53.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-12190",
    "datePublished": "2026-06-14T22:45:07.816Z",
    "dateReserved": "2026-06-14T06:38:49.912Z",
    "dateUpdated": "2026-06-15T10:37:48.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12189 (GCVE-0-2026-12189)

Vulnerability from cvelistv5 – Published: 2026-06-14 22:30 – Updated: 2026-06-15 15:06
VLAI
Title
Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme
Summary
A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation can lead to improper authorization in handler for custom url scheme. The attack can only be executed locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
4.8 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3 (Medium)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-15 15:00 UTC
CWE
  • CWE-939 - Improper Authorization in Handler for Custom URL Scheme
  • CWE-285 - Improper Authorization
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3880 records in the last 180 days details
References
Impacted products
Vendor Product Version
Moovit Bus & Public Transit App Affected: 1.18
    cpe:2.3:a:moovit:bus_public_transit_app:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
honest_corrupt (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12189",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T15:00:56.237337Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T15:06:15.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/submit/824449"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/honestcorrupt/MOOVIT-CVE-.git"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:moovit:bus_public_transit_app:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "com.tranzmate"
          ],
          "product": "Bus \u0026 Public Transit App",
          "vendor": "Moovit",
          "versions": [
            {
              "status": "affected",
              "version": "1.18"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "honest_corrupt (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Moovit Bus \u0026 Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation can lead to improper authorization in handler for custom url scheme. The attack can only be executed locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4.3,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "Improper Authorization in Handler for Custom URL Scheme",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T22:30:08.830Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-370835 | Moovit Bus \u0026 Public Transit App com.tranzmate improper authorization in handler for custom url scheme",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/370835"
        },
        {
          "name": "VDB-370835 | CTI Indicators (IOB, IOC)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/370835/cti"
        },
        {
          "name": "CVE-2026-12189 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-12189"
        },
        {
          "name": "Submit #824449 | Moovit Moovit Android Application 1.18 Improper Input Validation / Insecure Deep Link Handling / WebVie",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/824449"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/honestcorrupt/MOOVIT-CVE-.git"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://drive.google.com/file/d/1lKtJX8mhbGTiMarv2H3psd9iombJ-dIn/view?usp=sharing"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-14T08:42:00.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Moovit Bus \u0026 Public Transit App com.tranzmate improper authorization in handler for custom url scheme"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-12189",
    "datePublished": "2026-06-14T22:30:08.830Z",
    "dateReserved": "2026-06-14T06:36:17.689Z",
    "dateUpdated": "2026-06-15T15:06:15.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12065 (GCVE-0-2026-12065)

Vulnerability from cvelistv5 – Published: 2026-06-12 12:30 – Updated: 2026-06-12 15:19
VLAI
Title
Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme
Summary
A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the component WebView URL Handler. The manipulation leads to improper authorization in handler for custom url scheme. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Severity
1 (Low)
CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
1.8 (Low)
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
1.8 (Low)
CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-12 15:18 UTC
CWE
  • CWE-939 - Improper Authorization in Handler for Custom URL Scheme
  • CWE-285 - Improper Authorization
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3880 records in the last 180 days details
References
Impacted products
Vendor Product Version
Groww Stock, Mutual Fund, Gold App Affected: 20260805
    cpe:2.3:a:groww:stock_mutual_fund_gold_app:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
honest_corrupt (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12065",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T15:18:03.541331Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T15:19:01.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/honestcorrupt/CVE-req-Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:groww:stock_mutual_fund_gold_app:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "WebView URL Handler"
          ],
          "product": "Stock, Mutual Fund, Gold App",
          "vendor": "Groww",
          "versions": [
            {
              "status": "affected",
              "version": "20260805"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "honest_corrupt (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in Groww Stock, Mutual Fund, Gold App up to 20260805 on Android. This affects an unknown part of the component WebView URL Handler. The manipulation leads to improper authorization in handler for custom url scheme. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:P/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 1.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 1.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1,
            "vectorString": "AV:L/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "Improper Authorization in Handler for Custom URL Scheme",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T12:30:08.900Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-370560 | Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/370560"
        },
        {
          "name": "VDB-370560 | CTI Indicators (IOB, IOC)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/370560/cti"
        },
        {
          "name": "CVE-2026-12065 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-12065"
        },
        {
          "name": "Submit #822984 | Groww Groww Android Application Latest Available Version Weak Client-Side Protection and Unsafe WebView URL Handling",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/822984"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/honestcorrupt/Groww-Android-Application-Unsafe-WebView-URL-Handling-Weak-Client-Side-App-Lock-Enforcement.git"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://drive.google.com/drive/folders/1r9t4AuG747PmRbgLmY2CztsX5PTjQL19"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-12T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-12T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-12T09:38:15.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-12065",
    "datePublished": "2026-06-12T12:30:08.900Z",
    "dateReserved": "2026-06-12T07:32:56.280Z",
    "dateUpdated": "2026-06-12T15:19:01.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6445 (GCVE-0-2026-6445)

Vulnerability from cvelistv5 – Published: 2026-06-09 18:40 – Updated: 2026-06-09 20:03
VLAI
Summary
A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-09 20:03 UTC
CWE
  • CWE-939 - Improper authorization in handler for custom URL scheme
Assigner
Everpure CNA under the mitre root
CNA scorecard – unranked: 3 records in the last 180 days, 10 needed details
References
Impacted products
Vendor Product Version
Everpure FlashArray Affected: 6.5.0 , ≤ 6.5.8 (custom)
Affected: 6.10.0 , ≤ 6.10.5 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6445",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T20:03:00.931192Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T20:03:07.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FlashArray",
          "vendor": "Everpure",
          "versions": [
            {
              "lessThanOrEqual": "6.5.8",
              "status": "affected",
              "version": "6.5.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.10.5",
              "status": "affected",
              "version": "6.10.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges."
            }
          ],
          "value": "A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "CWE-939 Improper authorization in handler for custom URL scheme",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T18:40:03.334Z",
        "orgId": "3895c224-4e1d-482a-adb3-fa64795683ac",
        "shortName": "Everpure"
      },
      "references": [
        {
          "url": "https://support.purestorage.com/bundle/m_security_bulletins/page/Pure_Security/topics/concept/c_security_bulletins.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac",
    "assignerShortName": "Everpure",
    "cveId": "CVE-2026-6445",
    "datePublished": "2026-06-09T18:40:03.334Z",
    "dateReserved": "2026-04-16T18:24:18.478Z",
    "dateUpdated": "2026-06-09T20:03:07.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-3471 (GCVE-0-2026-3471)

Vulnerability from cvelistv5 – Published: 2026-05-18 08:45 – Updated: 2026-05-18 14:35
VLAI
Title
Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App
Summary
Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-18 14:34 UTC
CWE
  • CWE-939 - Improper Authorization in Handler for Custom URL Scheme
Assigner
Mattermost CNA under the mitre root
CNA scorecard B 80/100 over 107 records in the last 180 days details
References
URL Tags
https://mattermost.com/security-updates vendor-advisory
Impacted products
Vendor Product Version
Mattermost Mattermost Affected: 0 , ≤ 6.0.1 (semver)
Affected: 0 , ≤ 5.4.13 (semver)
Unaffected: 6.2.0
Unaffected: 6.1.1.0
Unaffected: 5.13.5.0
Create a notification for this product.
Credits
game0v3r
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3471",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-18T14:34:41.218853Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-18T14:35:23.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "6.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.2.0"
            },
            {
              "status": "unaffected",
              "version": "6.1.1.0"
            },
            {
              "status": "unaffected",
              "version": "5.13.5.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "game0v3r"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost Desktop App versions \u003c=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open(\u0027javascript:alert()\u0027);}}. Mattermost Advisory ID: MMSA-2026-00618"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "CWE-939: Improper Authorization in Handler for Custom URL Scheme",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-18T08:45:44.576Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "name": "MMSA-2026-00618",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost Desktop App to versions 6.2.0, 6.1.1.0, 5.13.5.0 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2026-00618",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-67756"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2026-3471",
    "datePublished": "2026-05-18T08:45:44.576Z",
    "dateReserved": "2026-03-03T10:41:41.370Z",
    "dateUpdated": "2026-05-18T14:35:23.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-1046 (GCVE-0-2026-1046)

Vulnerability from cvelistv5 – Published: 2026-02-16 12:10 – Updated: 2026-02-17 17:05
VLAI
Title
Arbitrary application execution via unvalidated server-controlled URLs in Help menu
Summary
Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577
Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-17 16:42 UTC
CWE
  • CWE-939 - Improper Authorization in Handler for Custom URL Scheme
Assigner
Mattermost CNA under the mitre root
CNA scorecard B 80/100 over 107 records in the last 180 days details
References
URL Tags
https://mattermost.com/security-updates vendor-advisory
Impacted products
Vendor Product Version
Mattermost Mattermost Affected: 0 , ≤ 6.2.0 (semver)
Affected: 0 , ≤ 5.2.13 (semver)
Unaffected: 6.1.0
Unaffected: 6.0.3.0
Unaffected: 5.13.3.0
Create a notification for this product.
Credits
hackerman70000
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1046",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-17T16:42:12.292444Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-17T17:05:58.569Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mattermost",
          "vendor": "Mattermost",
          "versions": [
            {
              "lessThanOrEqual": "6.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.2.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.0"
            },
            {
              "status": "unaffected",
              "version": "6.0.3.0"
            },
            {
              "status": "unaffected",
              "version": "5.13.3.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hackerman70000"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mattermost Desktop App versions \u003c=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user\u2019s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "CWE-939: Improper Authorization in Handler for Custom URL Scheme",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-16T12:10:38.668Z",
        "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "shortName": "Mattermost"
      },
      "references": [
        {
          "name": "MMSA-2026-00577",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mattermost.com/security-updates"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update Mattermost Desktop App to versions 6.1.0, 6.0.3.0, 5.13.3.0 or higher."
        }
      ],
      "source": {
        "advisory": "MMSA-2026-00577",
        "defect": [
          "https://mattermost.atlassian.net/browse/MM-67103"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Arbitrary application execution via unvalidated server-controlled URLs in Help menu",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
    "assignerShortName": "Mattermost",
    "cveId": "CVE-2026-1046",
    "datePublished": "2026-02-16T12:10:38.668Z",
    "dateReserved": "2026-01-16T16:24:48.693Z",
    "dateUpdated": "2026-02-17T17:05:58.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0243

Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-09 13:40
VLAI
Title
Alipay DeepLink+JSBridge Attack Chain: Silent GPS Exfiltration, 17 Vulns, 6 CVEs (CVSS 9.3)
Summary
Subject: Alipay DeepLink+JSBridge Attack Chain: Silent GPS Exfiltration, 17 Vulns, 6 CVEs (CVSS 9.3) # Alipay DeepLink + JSBridge Attack Chain # Silent GPS Exfiltration via Crafted URL ## Overview Researcher: Jiqiang Feng / Innora AI Security Research Vendor: Ant Group (蚂蚁集团) / Alibaba Group Product: Alipay (支付宝) v10.x (Android & iOS) Users Affected: 1 billion+ CVEs: 6 submitted to MITRE CNA-LR (2026-03-12) CVSS: 7.4–9.3 Vendor Response: "Normal functionality" Disclosure: Responsible (Feb 25 → Mar 11 public) ## Vulnerability Chain A single crafted URL triggers the following attack chain: 1. Open Redirect (CWE-601): ds.alipay.com/?scheme= accepts arbitrary URL parameters, redirecting to Alipay app via deep link 2. Whitelist Bypass (CWE-939): ds.alipay.com is a whitelisted Alipay domain, so the deep link handler trusts the redirect target 3. WebView Loading: Attacker-controlled page loads in Alipay's privileged WebView with JSBridge access 4. API Abuse: AlipayJSBridge.call() exposes sensitive native APIs without user consent ## Exploitable APIs (Verified) | # | API | Data Extracted | Android | iOS | |---|-----|---------------|---------|-----| | 1 | getLocation | GPS coords (8.8m accuracy) | ✓ | ✓ | | 2 | getNetworkType | WiFi/cellular, carrier info | ✓ | ✓ | | 3 | getSystemInfo | Device model, OS, screen | ✓ | ✓ | | 4 | getCameraPermission | Camera auth status | ✓ | ✓ | | 5 | getMicrophonePermission | Mic auth status | ✓ | ✓ | | 6 | tradePay | Pre-fill payment screen | ✗ | ✓ | | 7 | share | Trigger share dialog | ✗ | ✓ | | 8 | scan | Activate QR scanner | ✗ | ✓ | | 9 | chooseImage | Access photo picker | ✗ | ✓ | iOS attack surface is significantly larger than Android. ## PoC Trigger URL pattern: https://ds.alipay.com/?scheme=alipays://platformapi/startapp?appId=20000067&url=[BASE64_ENCODED_ATTACKER_URL] Verification page (read-only, no data collection): https://innora.ai/zfb/poc/trigger.html ## Verification - 3 devices: Samsung S25 Ultra (NZ), Xiaomi Redmi 12 (MY), iPhone 16 Pro (CN-Hangzhou) - 308 server-side exfiltration logs - 42 screenshots - Vendor's own security lead tested on iPhone from Hangzhou (Alipay HQ) — GPS captured silently in 7 seconds, accuracy 8.8m ## Timeline 2026-02-25: Initial TLS/SSL report to vendor 2026-03-06: Vendor: "cannot be practically exploited" 2026-03-07: Expanded report (17 vulns, full E2E proof) 2026-03-07: Whitelist bypass achieved in 2 min during live call with vendor 2026-03-08: Vendor's security lead's iPhone tested from Hangzhou — GPS captured 2026-03-10: Vendor final: "normal functionality" 2026-03-11: Public disclosure 2026-03-11: Vendor's law firm files takedown complaint (4 hours later) 2026-03-12: 6 CVEs submitted to MITRE ## Full Report https://innora.ai/zfb/ (bilingual EN/ZH) ## Notes - Alibaba is a registered CNA (CNA-2017-0006) but refused to assign CVEs - Vendor's law firm complaint targets an article that never once mentions "Alipay" or "Ant Group" by name - Vendor's security contact privately called it a "洞" (hole/vuln) while officially classifying as "normal functionality" ## Contact Jiqiang Feng | feng () innora ai | Innora AI Security Research _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Credits
Feng Ning via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Alipay DeepLink+JSBridge Attack",
          "vendor": "Ant Group (\u8682\u8681\u96c6\u56e2) / Alibaba Group",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Feng Ning via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Subject: Alipay DeepLink+JSBridge Attack Chain: Silent GPS Exfiltration, 17 Vulns, 6 CVEs (CVSS 9.3)\n\n# Alipay DeepLink + JSBridge Attack Chain\n# Silent GPS Exfiltration via Crafted URL\n\n## Overview\n\nResearcher: Jiqiang Feng / Innora AI Security Research\nVendor: Ant Group (\u8682\u8681\u96c6\u56e2) / Alibaba Group\nProduct: Alipay (\u652f\u4ed8\u5b9d) v10.x (Android \u0026 iOS)\nUsers Affected: 1 billion+\nCVEs: 6 submitted to MITRE CNA-LR (2026-03-12)\nCVSS: 7.4\u20139.3\nVendor Response: \"Normal functionality\"\nDisclosure: Responsible (Feb 25 \u2192 Mar 11 public)\n\n## Vulnerability Chain\n\nA single crafted URL triggers the following attack chain:\n\n1. Open Redirect (CWE-601): ds.alipay.com/?scheme= accepts arbitrary URL parameters, redirecting to Alipay app via deep \nlink\n2. Whitelist Bypass (CWE-939): ds.alipay.com is a whitelisted Alipay domain, so the deep link handler trusts the \nredirect target\n3. WebView Loading: Attacker-controlled page loads in Alipay\u0027s privileged WebView with JSBridge access\n4. API Abuse: AlipayJSBridge.call() exposes sensitive native APIs without user consent\n\n## Exploitable APIs (Verified)\n\n| # | API | Data Extracted | Android | iOS |\n|---|-----|---------------|---------|-----|\n| 1 | getLocation | GPS coords (8.8m accuracy) | \u2713 | \u2713 |\n| 2 | getNetworkType | WiFi/cellular, carrier info | \u2713 | \u2713 |\n| 3 | getSystemInfo | Device model, OS, screen | \u2713 | \u2713 |\n| 4 | getCameraPermission | Camera auth status | \u2713 | \u2713 |\n| 5 | getMicrophonePermission | Mic auth status | \u2713 | \u2713 |\n| 6 | tradePay | Pre-fill payment screen | \u2717 | \u2713 |\n| 7 | share | Trigger share dialog | \u2717 | \u2713 |\n| 8 | scan | Activate QR scanner | \u2717 | \u2713 |\n| 9 | chooseImage | Access photo picker | \u2717 | \u2713 |\n\niOS attack surface is significantly larger than Android.\n\n## PoC\n\nTrigger URL pattern:\nhttps://ds.alipay.com/?scheme=alipays://platformapi/startapp?appId=20000067\u0026url=[BASE64_ENCODED_ATTACKER_URL]\n\nVerification page (read-only, no data collection):\nhttps://innora.ai/zfb/poc/trigger.html\n\n## Verification\n\n- 3 devices: Samsung S25 Ultra (NZ), Xiaomi Redmi 12 (MY), iPhone 16 Pro (CN-Hangzhou)\n- 308 server-side exfiltration logs\n- 42 screenshots\n- Vendor\u0027s own security lead tested on iPhone from Hangzhou (Alipay HQ) \u2014 GPS captured silently in 7 seconds, accuracy \n8.8m\n\n## Timeline\n\n2026-02-25: Initial TLS/SSL report to vendor\n2026-03-06: Vendor: \"cannot be practically exploited\"\n2026-03-07: Expanded report (17 vulns, full E2E proof)\n2026-03-07: Whitelist bypass achieved in 2 min during live call with vendor\n2026-03-08: Vendor\u0027s security lead\u0027s iPhone tested from Hangzhou \u2014 GPS captured\n2026-03-10: Vendor final: \"normal functionality\"\n2026-03-11: Public disclosure\n2026-03-11: Vendor\u0027s law firm files takedown complaint (4 hours later)\n2026-03-12: 6 CVEs submitted to MITRE\n\n## Full Report\n\nhttps://innora.ai/zfb/ (bilingual EN/ZH)\n\n## Notes\n\n- Alibaba is a registered CNA (CNA-2017-0006) but refused to assign CVEs\n- Vendor\u0027s law firm complaint targets an article that never once mentions \"Alipay\" or \"Ant Group\" by name\n- Vendor\u0027s security contact privately called it a \"\u6d1e\" (hole/vuln) while officially classifying as \"normal functionality\"\n\n## Contact\n\nJiqiang Feng | feng () innora ai | Innora AI Security Research\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-939",
              "description": "CWE-939",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:40:47Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/4"
        },
        {
          "url": "https://ds.alipay.com/?scheme=alipays://platformapi/startapp?appId=20000067\u0026url=[BASE64_ENCODED_ATTACKER_URL"
        },
        {
          "url": "https://innora.ai/zfb/"
        },
        {
          "url": "https://innora.ai/zfb/poc/trigger.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Alipay DeepLink+JSBridge Attack Chain: Silent GPS Exfiltration, 17 Vulns, 6 CVEs (CVSS 9.3)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0243",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/4",
            "automated": true,
            "contentSha256": "c41650b65f5b5e3df47a5c82a69ed945e38f06dd504335c7dd62cf305b8c4dde",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-12T02:33:20Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-09T13:40:47Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0243"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-41408 (GCVE-0-2025-41408)

Vulnerability from cvelistv5 – Published: 2025-09-05 05:25 – Updated: 2025-09-05 13:45
VLAI
Summary
Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attack.
Severity
4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-05 13:38 UTC
CWE
  • CWE-939 - Improper authorization in handler for custom URL scheme
Assigner
jpcert CNA under the jpcert root
CNA scorecard C 64/100 over 190 records in the last 180 days details
References
Impacted products
Vendor Product Version
LY Corporation "Yahoo! Shopping" App for Android Affected: versions prior to 14.15.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41408",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-05T13:38:02.982750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-05T13:45:13.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "\"Yahoo! Shopping\" App for Android",
          "vendor": "LY Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions prior to 14.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authorization in handler for custom URL scheme issue in \"Yahoo! Shopping\" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attack."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "Improper authorization in handler for custom URL scheme",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-05T05:25:15.422Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://jvn.jp/en/jp/JVN35290164/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-41408",
    "datePublished": "2025-09-05T05:25:15.422Z",
    "dateReserved": "2025-08-29T01:43:32.740Z",
    "dateUpdated": "2025-09-05T13:45:13.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-54125 (GCVE-0-2024-54125)

Vulnerability from cvelistv5 – Published: 2024-12-17 05:36 – Updated: 2024-12-17 14:59
VLAI
Summary
Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
Severity
3.3 (Low)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-17 14:51 UTC
CWE
  • CWE-939 - Improper authorization in handler for custom URL scheme
Assigner
jpcert CNA under the jpcert root
CNA scorecard C 64/100 over 190 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-54125",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-17T14:51:40.440571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-17T14:59:39.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "\"Shonen Jump+\" App for Android",
          "vendor": "SHUEISHA INC.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 4.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authorization in handler for custom URL scheme issue in \"Shonen Jump+\" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "Improper authorization in handler for custom URL scheme",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-17T05:36:50.078Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://shonenjumpplus.com/article/info20241216"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN08430039/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-54125",
    "datePublished": "2024-12-17T05:36:50.078Z",
    "dateReserved": "2024-11-29T08:56:09.859Z",
    "dateUpdated": "2024-12-17T14:59:39.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-54014 (GCVE-0-2024-54014)

Vulnerability from cvelistv5 – Published: 2024-12-05 02:42 – Updated: 2024-12-05 11:33
VLAI
Summary
Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead the application to access an arbitrary web site via another application installed on the user's device.
Severity
3.6 (Low)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-05 11:33 UTC
CWE
  • CWE-939 - Improper authorization in handler for custom URL scheme
Assigner
jpcert CNA under the jpcert root
CNA scorecard C 64/100 over 190 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-54014",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-05T11:33:12.969638Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-05T11:33:27.693Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "\u0027Skylark\u0027 App for Android",
          "vendor": "SKYLARK HOLDINGS CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.13 and earlier"
            }
          ]
        },
        {
          "product": "\u0027Skylark\u0027 App for iOS",
          "vendor": "SKYLARK HOLDINGS CO., LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.13 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authorization in handler for custom URL scheme issue in \u0027Skylark\u0027 App for Android 6.2.13 and earlier and \u0027Skylark\u0027 App for iOS 6.2.13 and earlier allows an attacker to lead the application to access an arbitrary web site via another application installed on the user\u0027s device."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-939",
              "description": "Improper authorization in handler for custom URL scheme",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-05T02:42:14.019Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://play.google.com/store/apps/details?id=jp.co.skylark.app.gusto"
        },
        {
          "url": "https://apps.apple.com/jp/app/%E3%81%99%E3%81%8B%E3%81%84%E3%82%89%E3%83%BC%E3%81%8F%E3%82%A2%E3%83%97%E3%83%AA/id906930478"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03447226/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-54014",
    "datePublished": "2024-12-05T02:42:14.019Z",
    "dateReserved": "2024-11-27T08:11:25.031Z",
    "dateUpdated": "2024-12-05T11:33:27.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}
Mitigation
Architecture and Design
  • Utilize a user prompt pop-up to authorize potentially harmful actions such as those modifying data or dealing with sensitive information.
  • When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list