CWE-939 · Access Control
Improper Authorization in Handler for Custom URL Scheme
36CVEs
SortMost likely exploited
36 CVEs with CWE-939 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-11000Improper URL validation in GreenBrowserluchua-bc · GreenBrowser · CVSS 5.7 · 2020-04-08 | 5.7 | 1.2% | 2020-04-08 |
| CVE-2022-20736Cisco AppDynamics Controller Authorization Bypass VulnerabilityCisco · Cisco AppDynamics · CVSS 5.3 · 2022-06-15 | 5.3 | 1.1% | 2022-06-15 |
| CVE-2023-43582Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.Zoom Video Communications, Inc. · Zoom Clients · CVSS 5.5 · 2023-11-14 | 5.5 | 0.7% | 2023-11-14 |
| CVE-2026-26123Microsoft Authenticator Information Disclosure VulnerabilityMicrosoft · Microsoft Authenticator for Android · CVSS 5.5 · 2026-03-10 | 5.5 | 0.7% | 2026-03-10 |
| CVE-2026-21075Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.Samsung Mobile · My Galaxy · CVSS 5.3 · 2026-08-10 | 5.3 | 0.5% | 2026-08-10 |
| CVE-2024-33606MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL SchemeMicroDicom · DICOM Viewer · CVSS 8.8 · 2024-06-11 | 8.8 | 0.5% | 2024-06-11 |
| CVE-2026-35394Mobile Next has Arbitrary Android Intent Execution via mobile_open_urlmobile-next · mobile-mcp · CVSS 8.3 · 2026-04-06 | 8.3 | 0.4% | 2026-04-06 |
| CVE-2024-41918'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS 11.7.0 and earlier are vulnerable to improper authorization in handler for custom URL scheme.…Rakuten Group, Inc. · 'Rakuten Ichiba App' for Android · CVSS 3.1 · 2024-08-29 | 3.1 | 0.3% | 2024-08-29 |
| CVE-2026-53418Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege…Zoom Communications · Zoom Workplace · CVSS 8.1 · 2026-10-13 | 8.1 | 0.3% | 2026-10-13 |
| CVE-2024-45203Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS versions prior to 6.74.0 allows an attacke…istyle Inc. · "@cosme" App for Android · CVSS 4.3 · 2024-09-09 | 4.3 | 0.3% | 2024-09-09 |
| CVE-2024-35298Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary websi…ZOZO, Inc. · 'ZOZOTOWN' App for Android · CVSS 4.3 · 2024-06-19 | 4.3 | 0.3% | 2024-06-19 |
| CVE-2026-113411Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url schemeNerimity · Desktop · CVSS 6.3 · 2026-10-20 | 6.3 | 0.3% | 2026-10-20 |
| CVE-2026-106716ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall J…No vendor recorded · CVSS 6.5 · 2026-11-05 | 6.5 | 0.3% | 2026-11-05 |
| CVE-2026-6445A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges.Everpure · FlashArray · CVSS 8.7 · 2026-06-09 | 8.7 | 0.3% | 2026-06-09 |
| CVE-2025-41408Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a us…LY Corporation · "Yahoo! Shopping" App for Android · CVSS 5.3 · 2025-09-05 | 5.3 | 0.3% | 2025-09-05 |
| CVE-2026-1046Arbitrary application execution via unvalidated server-controlled URLs in Help menuMattermost · Mattermost · CVSS 7.6 · 2026-02-16 | 7.6 | 0.3% | 2026-02-16 |
| CVE-2026-33335Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternalgo-vikunja · vikunja · CVSS 6.4 · 2026-03-24 | 6.4 | 0.3% | 2026-03-24 |
| CVE-2026-91900Dell Alienware Command Center (AWCC), version(s) Versions up to and including 6.14.20.0, contain(s) an Improper Authorization in Handler for Custom URL Scheme vulnerability. An un…Dell · Alienware Command Center (AWCC) · CVSS 5.8 · 2026-11-02 | 5.8 | 0.3% | 2026-11-02 |
| CVE-2025-5020Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addressesMozilla · Firefox for iOS · CVSS 4.3 · 2025-05-21 | 4.3 | 0.2% | 2025-05-21 |
| CVE-2026-53407Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an…Zoom Communications · Zoom Workplace · CVSS 8.1 · 2026-06-12 | 8.1 | 0.2% | 2026-06-12 |
| CVE-2026-53408Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an…Zoom Communications · Zoom Workplace · CVSS 8.1 · 2026-06-12 | 8.1 | 0.2% | 2026-06-12 |
| CVE-2026-90631Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variablesApache Software Foundation · Apache OpenOffice · CVSS 3.3 · 2026-11-04 | 3.3 | 0.2% | 2026-11-04 |
| CVE-2024-54014Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to le…SKYLARK HOLDINGS CO., LTD. · 'Skylark' App for Android · CVSS 3.6 · 2024-12-05 | 3.6 | 0.2% | 2024-12-05 |
| CVE-2026-106715NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbrea…No vendor recorded · CVSS 5.4 · 2026-11-05 | 5.4 | 0.2% | 2026-11-05 |
| CVE-2026-96614"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser t…GEO CORPORATION · "ゲオアプリ" for Android · CVSS 5.1 · 2026-10-15 | 5.1 | 0.2% | 2026-10-15 |
| CVE-2026-3471Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop AppMattermost · Mattermost · CVSS 6.5 · 2026-05-18 | 6.5 | 0.2% | 2026-05-18 |
| CVE-2025-67739In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosureJetBrains · TeamCity · CVSS 3.1 · 2025-12-11 | 3.1 | 0.2% | 2025-12-11 |
| CVE-2024-54125Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary we…SHUEISHA INC. · "Shonen Jump+" App for Android · CVSS 3.3 · 2024-12-17 | 3.3 | 0.2% | 2024-12-17 |
| CVE-2026-118677n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instancen8n-io · n8n · CVSS 5.9 · 2026-10-28 | 5.9 | 0.2% | 2026-10-28 |
| CVE-2026-12065Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url schemeGroww · Stock, Mutual Fund, Gold App · CVSS 1.8 · 2026-06-12 | 1.8 | 0.2% | 2026-06-12 |
| CVE-2026-73335Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device…Digital Agency · Android App "Myna Point" · CVSS 4.6 · 2026-08-26 | 4.6 | 0.1% | 2026-08-26 |
| CVE-2026-91901Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Authorization in Handler for Custom URL Scheme vulnerability. A low privileged attacker with…Dell · Alienware Command Center (AWCC) · CVSS 3.5 · 2026-11-02 | 3.5 | 0.1% | 2026-11-02 |
| CVE-2026-21062Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.Samsung Mobile · Samsung Mobile Devices · CVSS 4.8 · 2026-08-10 | 4.8 | 0.1% | 2026-08-10 |
| CVE-2026-92862The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent.Wavedash Co., Ltd. · Ticket Ryutsu Center · CVSS 4.6 · 2026-10-08 | 4.6 | 0.1% | 2026-10-08 |
| CVE-2026-12190Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url schemeGenspark · AI Workspace App · CVSS 5.3 · 2026-06-14 | 5.3 | 0.1% | 2026-06-14 |
| CVE-2026-12189Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url schemeMoovit · Bus & Public Transit App · CVSS 5.3 · 2026-06-14 | 5.3 | 0.1% | 2026-06-14 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.