Ticket Ryutsu Center Android App Security Flaws

Hard-coded credentials embedded in the Ticket Ryutsu Center Android application (wavedash_co.,_ltd.) let anyone who downloads the publicly available Google Play package recover an API key used by the app through static analysis or decompilation. The vector (AV:L/PR:N/UI:N) shows the only prerequisite is local access to the distributed binary, meaning the extraction requires neither authentication nor user interaction, though the real-world blast radius depends entirely on the backend scope and permissions conferred by that key, which the JVN advisory does not document. Impact is therefore scored as limited confidentiality disclosure (CVSS 4.0, C:L/I:N/A:N per the independent assessment, which matches the NVD vector for this unauthenticated local-access flaw); no public exploit code and no confirmed active exploitation were identified at time of analysis.

Improper handling of custom URL schemes in the Android application Ticket Ryutsu Center allows a malicious co-resident app on the same device to send a crafted Intent that causes the victim app to open an arbitrary website. Exploitation requires a separate attacker-controlled application to already be installed and depends on user interaction; impact is limited to low integrity violation with no code execution, data theft, or availability loss. No public exploit identified at time of analysis, and the issue is assessed as genuinely low priority.