Weaknesses of type CWE-939

36 results

Autorização inadequada em manipulador de esquema de URL customizado

Quando um aplicativo registra um esquema de URL customizado (como `meuapp://`), ele pode receber requisições de qualquer origem — outra app, página web, script — sem validar quem está chamando. Se o manipulador não verifica corretamente se o chamador é confiável, um atacante consegue invocar funcionalidades sensíveis (abrir arquivos, executar ações, acessar dados) através de uma URL maliciosa.

Example

Um app bancário registra `banco://transferencia?valor=1000&conta=123` sem autenticar o chamador. Um site malicioso ou outra app inclui um link com esse esquema; quando o usuário clica, a transferência acontece automaticamente, porque o app confia em qualquer solicitação recebida.

How to mitigate

Sempre valide a origem do chamador (contexto do processo, certificado de assinatura da app no Android/iOS) antes de executar ações sensíveis. Use tokens ou mecanismos de intent-filter seguro, nunca confie apenas no esquema de URL. Quando possível, peça confirmação explícita do usuário para operações críticas.

CVE-2026-53407HIGHImproper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may alloEPSS 0.2%CVE-2026-53408HIGHImproper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may alloEPSS 0.2%CVE-2026-90631LOWApache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variablesEPSS 0.2%CVE-2024-54014LOWImproper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.EPSS 0.2%CVE-2026-96614MEDIUM"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cEPSS 0.2%CVE-2026-3471MEDIUMOpening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop AppEPSS 0.2%CVE-2025-67739LOWIn JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosureEPSS 0.2%CVE-2024-54125LOWImproper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker tEPSS 0.2%CVE-2026-118677MEDIUMn8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker InstanceEPSS 0.2%CVE-2026-12065LOWGroww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url schemeEPSS 0.2%CVE-2026-73335MEDIUMAndroid application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious applicationEPSS 0.1%CVE-2026-91901LOWDell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Authorization in Handler for Custom URL Scheme vulnerEPSS 0.1%CVE-2026-21062MEDIUMAuthorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.EPSS 0.1%CVE-2026-92862MEDIUMThe Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to anEPSS 0.1%CVE-2026-12189MEDIUMMoovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url schemeEPSS 0.1%CVE-2026-12190MEDIUMGenspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url schemeEPSS 0.1%