Weaknesses of type CWE-939

36 results

Autorização inadequada em manipulador de esquema de URL customizado

Quando um aplicativo registra um esquema de URL customizado (como `meuapp://`), ele pode receber requisições de qualquer origem — outra app, página web, script — sem validar quem está chamando. Se o manipulador não verifica corretamente se o chamador é confiável, um atacante consegue invocar funcionalidades sensíveis (abrir arquivos, executar ações, acessar dados) através de uma URL maliciosa.

Example

Um app bancário registra `banco://transferencia?valor=1000&conta=123` sem autenticar o chamador. Um site malicioso ou outra app inclui um link com esse esquema; quando o usuário clica, a transferência acontece automaticamente, porque o app confia em qualquer solicitação recebida.

How to mitigate

Sempre valide a origem do chamador (contexto do processo, certificado de assinatura da app no Android/iOS) antes de executar ações sensíveis. Use tokens ou mecanismos de intent-filter seguro, nunca confie apenas no esquema de URL. Quando possível, peça confirmação explícita do usuário para operações críticas.

CVE-2020-11000MEDIUMImproper URL validation in GreenBrowserEPSS 1.2%CVE-2021-31384HIGHJunos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the serviceEPSS 1.2%CVE-2022-20736MEDIUMCisco AppDynamics Controller Authorization Bypass VulnerabilityEPSS 1.1%CVE-2023-43582MEDIUMImproper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.EPSS 0.7%CVE-2026-26123MEDIUMMicrosoft Authenticator Information Disclosure VulnerabilityEPSS 0.7%CVE-2026-21075MEDIUMImproper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive informEPSS 0.5%CVE-2024-33606HIGHMicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL SchemeEPSS 0.5%CVE-2026-35394HIGHMobile Next has Arbitrary Android Intent Execution via mobile_open_urlEPSS 0.4%CVE-2026-59717MEDIUMHome Assistant Companion: `homeassistant://invite` Deep Link Credential PhishingEPSS 0.4%CVE-2024-41918LOW'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS 11.7.0 and earlier are vulnerable to improper authorizaEPSS 0.3%CVE-2026-53418HIGHImproper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated userEPSS 0.3%CVE-2024-45203MEDIUMImproper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS verEPSS 0.3%CVE-2024-35298MEDIUMImproper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lEPSS 0.3%CVE-2026-113411MEDIUMNerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url schemeEPSS 0.3%CVE-2026-6445HIGHA flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticatedEPSS 0.3%CVE-2025-41408MEDIUMImproper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remoteEPSS 0.3%CVE-2026-1046HIGHArbitrary application execution via unvalidated server-controlled URLs in Help menuEPSS 0.3%CVE-2026-33335MEDIUMVikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternalEPSS 0.3%CVE-2026-91900MEDIUMDell Alienware Command Center (AWCC), version(s) Versions up to and including 6.14.20.0, contain(s) an Improper Authorization in Handler forEPSS 0.3%CVE-2025-5020MEDIUMLinks using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addressesEPSS 0.2%