CVE-2026-68927

MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before appending a separately supplied android:port to the URL fetched by _check_url, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With an attacker-controlled hostname and DNS rebinding between validation and the requests.get connection, the request can reach an internal service, although redirects remain disabled and the path is fixed. This issue is fixed in version 4.5.1.

• CWE-918

• https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-95px-34x5-p37h
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-95px-34x5-p37h

Published

Aug 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-68919GoCD is a continuous deliver server. From 13.3.0 until 26.1.…7
• CVE-2026-6892Improper handling of symbolic links in the installer of CUPS…5.1
• CVE-2026-68921DiceBear is an avatar library for designers and developers. …4.7
• CVE-2026-68922MobSF is a mobile application security testing tool used. Pr…5.5
• CVE-2026-68923MobSF is a mobile application security testing tool used. Pr…6.5
• CVE-2026-68924MobSF is a mobile application security testing tool used. Pr…4.9
• CVE-2026-68928Acode is a powerful text and code editor for Android. From 1…8.6
• CVE-2026-68929FastGPT is an open-source LLM platform for building AI appli…9.3
• CVE-2026-6893A flaw was found in dracut. A remote attacker on the adjacen…7.5
• CVE-2026-68930Russh is a Rust SSH client & server library. Prior to 0.62.5…6.5
• CVE-2026-68939Pyenv provides simple Python version management. Prior to 2.…2
• CVE-2026-68941Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…