Skip to content
OpenAdvisories

Weakness (CWE)

CWE-939: Improper Authorization in Handler for Custom URL Scheme

Base Incomplete

The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

More detail

Mobile platforms and other architectures allow the use of custom URL schemes to facilitate communication between applications. In the case of iOS, this is the only method to do inter-application communication. The implementation is at the developer's discretion which may open security flaws in the application. An example could be potentially dangerous functionality such as modifying files through a custom URL scheme.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Utilize a user prompt pop-up to authorize potentially harmful actions such as those modifying data or dealing with sensitive information.

    When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.

Source: MITRE CWE-939

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.1
    CVE-2026-53418

    Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an…

    Zoom Communications Zoom Workplace
  • High 8.1
    CVE-2026-53408

    Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7…

    Zoom Communications Zoom Workplace
  • High 8.1
    CVE-2026-53407

    Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7…

    Zoom Communications Zoom Workplace
  • High 8.7
    CVE-2026-6445

    A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive informatio…

    Everpure FlashArray
  • High 8.3
    CVE-2026-35394

    Mobile Next has Arbitrary Android Intent Execution via mobile_open_url

    Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobile_open_url tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android in…

    mobile-next mobile-mcp @mobilenext/mobile-mcp npm
  • High 7.6
    CVE-2026-1046

    Arbitrary application execution via unvalidated server-controlled URLs in Help menu

    Mattermost Desktop App versions <=6.0 6.2.0 5.2.13.0 fail to validate help links which allows a malicious Mattermost server to execute arbitrary executables on a user’s system via the user clicking on certain items in the Help menu Mattermost Advisory ID: MMS…

    Mattermost Mattermost
  • High 8.8
    CVE-2024-33606

    MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL Scheme

    An attacker could retrieve sensitive files (medical images) as well as plant new medical images or overwrite existing medical images on a MicroDicom DICOM Viewer system. User interaction is required to exploit this vulnerability.

    MicroDicom DICOM Viewer
  • High 7.2
    CVE-2021-31384

    Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service

    Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interf…

    Juniper Networks Junos OS Network devices