CWE-939: Improper Authorization in Handler for Custom URL Scheme
The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
A kind of CWE-862 Missing Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- apache openoffice Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables 3.3 Low
- dell alienware command center (awcc) Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper... 3.5 Low
- dell alienware command center (awcc) Dell Alienware Command Center (AWCC), version(s) Versions up to and including 6.14.20.0, contain... 5.8 Medium
- n8n-io n8n n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance 5.9 Medium
- nerimity desktop Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme 5.3 Medium
- geo corporation "ゲオアプリ" for android, "ゲオアプリ" for ios +1 more "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a... 5.1 Medium
- zoom communications workplace Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before... 8.1 High
- wavedash co., ltd. ticket ryutsu center The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a... 4.6 Medium
- digital agency android app "myna point" Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom... 4.6 Medium
- samsung mobile my galaxy Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows... 5.3 Medium
- samsung android, samsung mobile devices +1 more Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local... 4.8 Medium
- home-assistant core Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing 4.3 Medium
- genspark ai workspace app Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme 4.8 Medium
- moovit bus & public transit app Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme 4.8 Medium
- zoom workplace, meeting software development kit +1 more Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4... 8.1 High
- zoom workplace Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4... 8.1 High
- groww stock, mutual fund, gold app Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme 1.0 Low
- everpure flasharray A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could... 8.7 High
- mattermost, mattermost desktop +1 more Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App 6.5 Medium
- mobile-next mobile-mcp, mobilenexthq mobile mcp +1 more Mobile Next has Arbitrary Android Intent Execution via mobile_open_url 8.3 High
- go-vikunja vikunja Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal 6.4 Medium
- microsoft authenticator, authenticator for android, authenticator for ios +2 more Microsoft Authenticator Information Disclosure Vulnerability 5.5 Medium
- mattermost, mattermost desktop +1 more Arbitrary application execution via unvalidated server-controlled URLs in Help menu 7.6 High
- jetbrains teamcity In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local... 3.1 Low
- ly corporation "yahoo! shopping" app for android Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for... 5.3 Medium
- mozilla firefox, firefox for ios +1 more Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses 4.3 Medium
- shueisha inc. "shonen jump+" app for android Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android... 3.3 Low
- skylark holdings co., ltd. 'skylark' app for android, 'skylark' app for ios +1 more Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13... 3.6 Low
- istyle inc. "@cosme" app for android, "@cosme" app for ios, istyle \@cosme +2 more Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android... 4.3 Medium
- rakuten ichiba, rakuten group, inc. 'rakuten ichiba app' for android, 'rakuten ichiba app' for ios +2 more 'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS 11.7.0 and... 6.1 Medium
- zozo, inc. 'zozotown' app for android Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android... 4.3 Medium
- microdicom dicom viewer MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL Scheme 8.6 High
- zoom, zoom communications inc. clients, zoom meetings +2 more +4 more Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation... 5.5 Medium
- cisco appdynamics controller, appdynamics +1 more Cisco AppDynamics Controller Authorization Bypass Vulnerability 5.3 Medium
- juniper junos, juniper networks junos os +1 more Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service 7.2 High
- greenbrowser project greenbrowser Improper URL validation in GreenBrowser 5.7 Medium