CWE-939

{
  "affected": [],
  "aliases": [
    "CVE-2023-43582"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-939"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-15T00:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.\n",
  "id": "GHSA-4w34-678c-q5hp",
  "modified": "2024-09-19T15:30:47Z",
  "published": "2023-11-15T00:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43582"
    },
    {
      "type": "WEB",
      "url": "https://explore.zoom.us/en/trust/security/security-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-53408"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-939"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-12T19:16:30Z",
    "severity": "HIGH"
  },
  "details": "Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticated user to conduct an escalation of privilege via network access.",
  "id": "GHSA-589r-wg5p-vwjq",
  "modified": "2026-06-12T21:31:45Z",
  "published": "2026-06-12T21:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53408"
    },
    {
      "type": "WEB",
      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26010"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-26123"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-939"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-10T20:16:34Z",
    "severity": "MODERATE"
  },
  "details": "Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally.",
  "id": "GHSA-5mf6-5mjf-6v7r",
  "modified": "2026-03-10T21:32:17Z",
  "published": "2026-03-10T21:32:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26123"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26123"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@mobilenext/mobile-mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.50"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35394"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-939"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-04T05:37:10Z",
    "nvd_published_at": "2026-04-06T21:16:21Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe `mobile_open_url` tool in mobile-mcp passes user-supplied URLs directly to Android\u0027s intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls, SMS messages, and content provider access.\n\n### Details\n\nThe vulnerable code passes URLs directly to `adb shell am start -a android.intent.action.VIEW -d \u003curl\u003e` without checking the URL scheme. This can enable malicious schemes such as `tel:`, `sms:`, `mailto:`, `content://`, and `market://` to be executed.\n\nSince MCP servers are designed to be operated by AI agents, which are vulnerable to prompt injection attacks, a malicious document or website could inject instructions that cause the AI to execute dangerous intents on a connected mobile device.\n\n### Impact\n\nAn attacker via prompt injection can:\n- Execute USSD codes (e.g., `tel:*#06#` to display IMEI - confirmed on Pixel 7a, behavior varies by device; or device-specific factory reset codes)\n- Initiate phone calls to premium rate numbers\n- Draft SMS messages with attacker-controlled content\n- Access content providers (contacts, SMS, call logs)\n- Open app installation prompts\n\n### Proof of Concept\n```json\n{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"mobile_open_url\",\"arguments\":{\"device\":\"\u003cid\u003e\",\"url\":\"tel:*#06#\"}}}\n```\n\nResult: IMEI displayed on device.\n```json\n{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/call\",\"params\":{\"name\":\"mobile_open_url\",\"arguments\":{\"device\":\"\u003cid\u003e\",\"url\":\"sms:1234567890?body=HACKED\"}}}\n```\n\nResult: SMS app opens with a pre-filled message.\n\n### Remediation\n\nUpgrade to version 0.0.50 or later, which restricts `mobile_open_url` to `http://` and `https://` schemes by default. Users who require other URL schemes can opt in by setting `MOBILEMCP_ALLOW_UNSAFE_URLS=1`.",
  "id": "GHSA-5qhv-x9j4-c3vm",
  "modified": "2026-04-06T23:43:53Z",
  "published": "2026-04-04T05:37:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-5qhv-x9j4-c3vm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35394"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mobile-next/mobile-mcp/pull/299"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mobile-next/mobile-mcp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.50"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-54125"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-939"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-17T06:15:21Z",
    "severity": "LOW"
  },
  "details": "Improper authorization in handler for custom URL scheme issue in \"Shonen Jump+\" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.",
  "id": "GHSA-6wm5-g9m5-854v",
  "modified": "2024-12-17T06:30:33Z",
  "published": "2024-12-17T06:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54125"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN08430039"
    },
    {
      "type": "WEB",
      "url": "https://shonenjumpplus.com/article/info20241216"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-5020"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-939"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-21T18:15:53Z",
    "severity": "MODERATE"
  },
  "details": "Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client This vulnerability affects Firefox for iOS \u003c 139.",
  "id": "GHSA-7mfw-wgr7-m3jg",
  "modified": "2025-05-21T21:31:40Z",
  "published": "2025-05-21T18:33:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5020"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1951558"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-39"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-67739"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-939"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-11T16:16:35Z",
    "severity": "LOW"
  },
  "details": "In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure",
  "id": "GHSA-9fw6-p89c-j42v",
  "modified": "2025-12-11T18:30:44Z",
  "published": "2025-12-11T18:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67739"
    },
    {
      "type": "WEB",
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-35298"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-939"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T05:15:51Z",
    "severity": "MODERATE"
  },
  "details": "Improper authorization in handler for custom URL scheme issue in \u0027ZOZOTOWN\u0027 App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user\u0027s device. As a result, the user may become a victim of a phishing attack.",
  "id": "GHSA-cvwq-q64c-wrq2",
  "modified": "2024-07-03T18:45:50Z",
  "published": "2024-06-19T06:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35298"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN37818611"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-3471"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-939"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-18T09:16:22Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost Desktop App versions \u003c=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open(\u0027javascript:alert()\u0027);}}. Mattermost Advisory ID: MMSA-2026-00618",
  "id": "GHSA-fhqj-97rr-gvhp",
  "modified": "2026-05-18T09:31:48Z",
  "published": "2026-05-18T09:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3471"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-1046"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-939"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-16T13:16:00Z",
    "severity": "HIGH"
  },
  "details": "Mattermost Desktop App versions \u003c=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user\u2019s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMSA-2026-00577",
  "id": "GHSA-gjx5-j34g-5g5p",
  "modified": "2026-03-23T18:30:25Z",
  "published": "2026-02-16T15:32:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1046"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}