Creema App CVE-2026-72528

Exploitation requires the victim to actively open an attacker-crafted URL that is handled by the Creema app (UI:A/UI:R), after which the app renders the attacker-controlled destination inside its own screen. No authentication is required (PR:N), and no special app configuration is implied by the description - the redirect behavior appears to affect the app's default URL handling. The key limiting factors are: (1) mandatory user interaction with a malicious link, meaning successful exploitation depends on social engineering; (2) impact is confined to displaying attacker content for phishing (integrity-low) with no direct data theft or code execution; and (3) the victim must have the Creema Android or iOS app installed.

This is a medium-severity open redirect (CWE-601) in the Creema handmade marketplace mobile apps for Android and iOS, reported by JPCERT/CC (JVN48627289). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N) scores 5.1 and is internally consistent with the description: network-reachable, low attack complexity, no privileges required, but user interaction is required (the victim must open a specially crafted URL). The only impact is low integrity (VI:L) - an attacker-controlled page is rendered inside the app's screen - with no confidentiality (VC:N) or availability (VA:N) impact and no scope change to other systems. There is NO EPSS score, NO SSVC decision data, and NO POC provided in the input, and the vulnerability is NOT listed in CISA KEV; therefore there is no public exploit identified at time of analysis. The practical risk is driven entirely by social engineering: the flaw itself grants no code execution or data access, so it is a phishing-enabler rather than a direct-compromise bug. This is a genuine but modest priority - real enough to patch, but the mandatory user interaction, the phishing-only impact, and the absence of any exploitation signals (no KEV, no POC, no EPSS) place it well below high-CVSS network RCE-class issues.

An attacker crafts a malicious URL leveraging the app's open redirect and distributes it via email, SMS, social media, or a messaging app to Creema users. When a victim taps the link and it opens in the Creema app, an attacker-controlled web page (e.g., a fake Creema login or payment page) is displayed within the trusted app's screen, and the victim enters credentials or payment data believing it is legitimate. No public exploit code is identified at time of analysis, so exploitation currently depends on an attacker independently building the crafted URL and a successful lure.