CVE-2024-41955
Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.
- Record
CVE-2024-41955- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2024-2299
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.
- Record
EUVD-2024-2299- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8m9j-2f32-2vx4
MobSF vulnerable to Open Redirect in Login Redirect
Impact
What kind of vulnerability is it? Who is impacted?
An open redirect vulnerability exist in MobSF authentication view.
PoC
- Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.
- Enter credentials and press "Sign In".
- You will be redirected to afine.com
Users who are not using authentication are not impacted.
Patches
Has the problem been patched? What versions should users upgrade to?
Update to MobSF v4.0.5
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading? Disable Authentication
References
Are there any links users can visit to find out more? Fix: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8
Reporter
Marcin Węgłowski (AFINE Team)
- Record
GHSA-8m9j-2f32-2vx4- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.
- Record
CVE-2024-41955- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.
- Record
CVE-2024-41955- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVGHSA-8m9j-2f32-2vx4
MobSF vulnerable to Open Redirect in Login Redirect
Impact
What kind of vulnerability is it? Who is impacted?
An open redirect vulnerability exist in MobSF authentication view.
PoC
- Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.
- Enter credentials and press "Sign In".
- You will be redirected to afine.com
Users who are not using authentication are not impacted.
Patches
Has the problem been patched? What versions should users upgrade to?
Update to MobSF v4.0.5
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading? Disable Authentication
References
Are there any links users can visit to find out more? Fix: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8
Reporter
Marcin Węgłowski (AFINE Team)
- Record
GHSA-8m9j-2f32-2vx4- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVPYSEC-2026-1669
MobSF vulnerable to Open Redirect in Login Redirect
Impact
What kind of vulnerability is it? Who is impacted?
An open redirect vulnerability exist in MobSF authentication view.
PoC
- Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.
- Enter credentials and press "Sign In".
- You will be redirected to afine.com
Users who are not using authentication are not impacted.
Patches
Has the problem been patched? What versions should users upgrade to?
Update to MobSF v4.0.5
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading? Disable Authentication
References
Are there any links users can visit to find out more? Fix: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8
Reporter
Marcin Węgłowski (AFINE Team)
- Record
PYSEC-2026-1669- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Open Redirect in Login Redirect - MobSF |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-41955 is a medium vulnerability (CVSS 5.2) in Opensecurity Mobile Security Framework, published July 31, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in mobsf 4.0.5.
References
github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8m9j-2f32-2vx4
nvd.nist.gov/vuln/detail/CVE-2024-41955
pypi.org/project/mobsf