Falhas do tipo CWE-939

36 resultados

Autorização inadequada em manipulador de esquema URL customizado

Aplicações registram esquemas de URL customizados (como 'meuapp://') sem validar adequadamente quem pode acioná-los. Isso permite que outras apps ou sites abram URLs especiais e executem ações sensíveis (transferências, exclusões, mudanças de configuração) sem a devida autenticação ou autorização do usuário.

Exemplo

Um app bancário registra 'meubank://transferir?destino=123&valor=1000' sem verificar se a requisição vem de uma fonte confiável. Um site malicioso ou app concorrente injeta essa URL, causando uma transferência sem consentimento do usuário.

Como mitigar

Implemente validação rigorosa: (1) autentique o chamador (verifique origem/assinatura), (2) valide cada parâmetro da URL, (3) exija confirmação explícita do usuário para ações sensíveis, (4) use intent filters restritos no Android ou schemes assinados no iOS.

CVE-2026-53407HIGHImproper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may alloEPSS 0.2%CVE-2026-53408HIGHImproper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may alloEPSS 0.2%CVE-2026-90631LOWApache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variablesEPSS 0.2%CVE-2024-54014LOWImproper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.EPSS 0.2%CVE-2026-96614MEDIUM"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cEPSS 0.2%CVE-2026-3471MEDIUMOpening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop AppEPSS 0.2%CVE-2025-67739LOWIn JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosureEPSS 0.2%CVE-2024-54125LOWImproper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker tEPSS 0.2%CVE-2026-118677MEDIUMn8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker InstanceEPSS 0.2%CVE-2026-12065LOWGroww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url schemeEPSS 0.2%CVE-2026-73335MEDIUMAndroid application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious applicationEPSS 0.1%CVE-2026-91901LOWDell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Authorization in Handler for Custom URL Scheme vulnerEPSS 0.1%CVE-2026-21062MEDIUMAuthorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access clipboard data.EPSS 0.1%CVE-2026-92862MEDIUMThe Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to anEPSS 0.1%CVE-2026-12189MEDIUMMoovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url schemeEPSS 0.1%CVE-2026-12190MEDIUMGenspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url schemeEPSS 0.1%