Log in Start free

Vulnerability · Published Jun 14, 2026 · Assigned by VulDB

CVE-2026-12189Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme

Medium 5.3

In plain English

A medium-severity security flaw in Bus & Public Transit App from Moovit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.1%top 98.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation can lead to improper authorization in handler for custom url scheme. The attack can only be executed locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
Moovit Bus & Public Transit App 1.18

Weakness: CWE-939, CWE-285 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References