CVE-2026-92862 Details
Description
The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent.
A vulnerability exists in the Android application "Ticket Ryutsu Center" by Wavedash Co., Ltd., affecting versions through 4.1.9. The issue arises from the application's improper management of custom URL schemes, which allows a malicious app to send a crafted Intent that directs the user to an arbitrary website via the Ticket Ryutsu Center app.
Users are advised to update the application to version 4.2.0 or later, which addresses this vulnerability. The developer has deactivated the vulnerable API key, ensuring that no information from the previous version can be misused.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://jvn.jp/en/jp/JVN53292492/ | [email protected] | AdvisoryBundleRemedy |
| https://play.google.com/store/apps/details?id=jp.co.ticket | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-939 | Improper Authorization in Handler for Custom URL Scheme | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wavedash Co., Ltd. Ticket Ryutsu Center | <= 4.1.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |