MobSF CVE-2026-68923

The victim must be actively authenticated to MobSF (holding a valid session cookie) and must visit an attacker-controlled webpage during that session - this is the required user interaction (UI:R). The attacker needs no credentials or privileges on MobSF itself (PR:N); the victim's session provides all necessary authorization. For /delete_scan/ and /download_scan/, the attacker must know or obtain a valid scan MD5 hash; for /change_password/, /create_user/, and /delete_user/, only the MobSF instance URL is required. The attack depends on SameSite=Lax session cookie behavior, which permits form-based top-level navigation POST submissions to carry the cookie - this is the critical enabling factor. MobSF must be network-reachable from the webpage hosting the exploit (e.g., on the same local network or exposed to the internet). Exploitation is limited by: required user interaction (analyst must actively visit the malicious page), typical localhost/private-network deployment of MobSF, and the need to know a scan MD5 for hash-dependent endpoints.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N scores 6.5, reflecting low attack complexity and high integrity impact, offset by required user interaction. The integrity impact is accurate: unauthenticated attackers can trigger password resets, account creation/deletion, and scan management on behalf of a logged-in victim. Publicly available exploit code exists (confirmed in GHSA-3p54-567p-2wpr with a working curl proof-of-concept demonstrating live scan deletion); this is not active CISA KEV exploitation. EPSS data was not provided. Real-world risk is bounded by MobSF's typical deployment pattern - it generally runs on localhost or private lab networks, which limits the attacker's ability to reach the target endpoint. However, teams exposing MobSF on internal or public networks are at meaningful risk. The scan deletion and user management endpoints represent the highest-impact targets. One data signal discrepancy: the CVSS A:N metric does not account for permanent data destruction via /delete_scan/, which has a de facto availability impact on scan data.

An attacker who knows or guesses a victim's MobSF instance URL hosts a webpage containing a hidden HTML form with JavaScript auto-submission targeting http://target-mobsf:8000/delete_scan/ with a known scan MD5 hash. When a security analyst authenticated to MobSF visits this page - for example, via a phishing link or a compromised web asset - the browser automatically submits the form, carrying the analyst's session cookie due to SameSite=Lax semantics, and MobSF deletes the scan without any CSRF validation. A confirmed working proof-of-concept for this exact scenario is included in GHSA-3p54-567p-2wpr.