Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M
CVE-2026-68927MobSF: SSRF port restriction bypass in assetlinks_check
Low 3.0
In plain English
A low-severity server-side request forgery in Mobile-Security-Framework-MobSF from MobSF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before appending a separately supplied android:port to the URL fetched by _check_url, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With an attacker-controlled hostname and DNS rebinding between validation and the requests.get connection, the request can reach an internal service, although redirects remain disabled and the path is fixed. This issue is fixed in version 4.5.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | mobsf | 4.5.1 | GHSA-95px-34x5-p37h |
| PyPI | mobsf | 4.5.1 | PYSEC-2026-3690 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MobSF | Mobile-Security-Framework-MobSF | < 4.5.1 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
References
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-95px-34x5-p37h x_refsource_CONFIRM
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627 x_refsource_MISC
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf x_refsource_MISC
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1 x_refsource_MISC