CVE-2026-96614 Details
Description
"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID.
A vulnerability exists in the "ゲオアプリ" (Geo App) for iOS, developed by GEO CORPORATION, prior to version 11.8.6. This vulnerability involves improper authorization in the handler for a custom URL scheme, which could allow an attacker to manipulate the application's in-app browser to visit arbitrary websites. Such exploitation could lead to phishing attacks or the unauthorized disclosure of a service's session ID.
Users are advised to update the application to the latest version, 11.8.8, available on the App Store.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://apps.apple.com/jp/app/id590190880 | [email protected] | ProductVendor |
| https://jvn.jp/en/jp/JVN40460777/ | [email protected] | AdvisoryBundleRemedy |
| https://play.google.com/store/apps/details?id=jp.co.geoonline.app&hl=ja | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-939 | Improper Authorization in Handler for Custom URL Scheme | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GEO CORPORATION ゲオアプリ | <= 11.8.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |