EUVD-2026-36668
GHSA-g5v4-4fxp-3rxp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low-privilege co-resident app required; limited confidentiality, integrity, and availability impact; no scope change to other system components.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation can lead to improper authorization in handler for custom url scheme. The attack can only be executed locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper authorization in Moovit Bus & Public Transit App 1.18 on Android exposes the com.tranzmate custom URL scheme handler to invocation by any locally installed application without proper authorization checks, enabling information disclosure and limited unauthorized manipulation of app functionality. The vulnerability is classified as CWE-939 and is restricted to local attack vectors, meaning a co-resident malicious application on the same Android device is required to trigger it. A proof-of-concept exploit has been publicly released via GitHub and Google Drive, and the vendor did not respond to responsible disclosure - no patch is confirmed available at time of analysis.
Technical ContextAI
CWE-939 (Improper Authorization in Handler for Custom URL Scheme) describes a class of vulnerability where an Android application registers a custom URI scheme or deep-link Intent filter but fails to validate whether the invoking caller is authorized. On Android, any installed app can send an Intent targeting a registered scheme, and without proper origin validation or signature-level permissions, the handler will process the request as if it were legitimate. The affected component is the com.tranzmate package - the core namespace of the Moovit transit application - which registers such a scheme handler. The CPE string cpe:2.3:a:moovit:bus_&_public_transit_app:*:*:*:*:*:*:*:* covers the broader Moovit app product line, though the disclosed vulnerable version is specifically 1.18. Tags indicating 'Information Disclosure' and 'Google' suggest the handler may expose user transit data or session-related details that could be harvested by a co-resident malicious app.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to the responsible disclosure. Users should update the Moovit app to the latest available version from the Google Play Store on the chance a silent fix has been shipped, and monitor the VulDB entry at https://vuldb.com/cve/CVE-2026-12189 for status changes. As a compensating control, users can uninstall Moovit if transit app functionality is not essential, eliminating the attack surface entirely. Organizations managing Android fleets via MDM should consider restricting installation of untrusted or sideloaded applications, which removes the co-resident malicious-app prerequisite. Android users can also review and revoke permissions granted to co-resident apps that have no legitimate need for Intent broadcasting. Enterprise environments should treat this as a risk acceptance decision until a vendor patch is confirmed.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today