EUVD-2026-94676
GHSA-vrcp-3fpm-6cfc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall malicious app on device
-
ExploitCraft Intent abusing custom URL scheme
-
ExecutionUser interaction triggers handler
-
ImpactApp opens attacker-controlled website
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V4 - API and Web Service Improper authorization in handler
|
| Exploitation Conditions | Requires a separate malicious application already installed on the same Android device as the Ticket Ryutsu Center app; the attacker app sends a crafted Intent that abuses the victim app's custom URL scheme handler (CWE-939). Exploitation is further limited by the local attack vector (AV:L - no remote/network reach), the need for user interaction (UI:R), and the fact that impact is confined to opening an arbitrary website (I:L) with no code execution, data theft, or availability loss. Not exploitable against a default standalone install without the attacker's co-resident app. |
| Impact | All signals point to a genuinely low-priority issue. The provided CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 3.3) describes a locally-exploitable flaw requiring a malicious app co-resident on the device plus user interaction, with only a low integrity impact (forced navigation to an attacker-chosen website) and no confidentiality or availability loss. No EPSS score was supplied, the CVE is not in CISA KEV, and no POC was referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the signals - the low CVSS, local vector, and absence of exploitation evidence are mutually consistent. The one caveat: the 'Information Disclosure' tag contradicts the CVSS metrics (C:N indicates no confidentiality impact; the real impact is integrity/forced navigation), so do not treat this as a data-exfiltration bug. This is a high-noise, low-real-risk mobile app finding, not an urgent patch priority. |
| Exploit ScenarioDerived | A user installs both the legitimate Ticket Ryutsu Center app and a malicious app on the same Android device. The malicious app sends a crafted Intent abusing the victim app's improperly handled custom URL scheme, and when the user interacts with the resulting flow the app silently opens an attacker-controlled website (e.g. a phishing or drive-by page). No public exploit code is referenced, and the local attack vector plus required user interaction keep practical impact limited. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Improper handling of custom URL schemes in the Android application Ticket Ryutsu Center allows a malicious co-resident app on the same device to send a crafted Intent that causes the victim app to open an arbitrary website. Exploitation requires a separate attacker-controlled application to already be installed and depends on user interaction; impact is limited to low integrity violation with no code execution, data theft, or availability loss. No public exploit identified at time of analysis, and the issue is assessed as genuinely low priority.
RemediationAI
No vendor-released patch identified at time of analysis; check the JVN advisory at https://jvn.jp/en/jp/JVN53292492/ and the Google Play listing at https://play.google.com/store/apps/details?id=jp.co.ticket for an updated app version, and apply it if one becomes available. Because the attack requires a malicious co-resident app and user interaction, users can reduce exposure by installing applications only from trusted sources such as Google Play and avoiding sideloaded APKs, but this does not fully eliminate the risk from already-installed malicious apps. Developers should implement strict validation and authorization for custom URL scheme handlers, restrict exported Android components, and prevent automatic navigation to URLs supplied through Intents. If a patched release is published, updating via the Play Store is the primary remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ticket Ryutsu Center is an Android application from Wavedash Co., Ltd., identified by CPE cpe:2.3:a:wavedash_co.,_ltd.:ticket_ryutsu_center:*:*:*:*:*:*:*:*; the wildcard version means all versions covered by the supplied CPE are potentially affected. The root cause is CWE-939, Improper Authorization in Handler for Custom URL Scheme: the app registers a custom URL scheme and does not properly validate or authorize the caller or the target URL, so any other installed app can invoke the handler with a crafted Intent. The assessed vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N indicates a local attack vector, no privileges required by the attacker, required user interaction, and only low integrity impact; the crafted Intent can force navigation to an arbitrary website but cannot execute code, steal data, or affect availability. This is consistent with the independent assessment that exploitation needs a malicious app already resident on the device and does not work against a default standalone installation.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Attack originates from a co-resident malicious app via Intent so AV:L; no privileges needed (PR:N) but user interaction required (UI:R); only forced navigation, hence I:L and C/A:N.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Ticket Ryutsu Center Android App Security Flaws
View all 2Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB