PYSEC-2026-3690 MobSF has SSRF port restriction bypass in assetlinks_check

Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

MobSF has SSRF port restriction bypass in assetlinks_check

SummaryMobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

GHSA-95PX-34X5-P37H MobSF has SSRF port restriction bypass in assetlinks_check

Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

MobSF has SSRF port restriction bypass in assetlinks_check

Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

Server-side Request Forgery (SSRF)

Overview mobsf is a Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Affected versions of this package are vulnerable to Server-side...

EUVD-2026-61133

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...

CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...

CVE-2026-68927

MobSF (Mobile Security Framework) prior to 4.5.1 contains an SSRF port restriction bypass in the Android App Link assetlinks checker. The function get_browsable_activities in manifest_analysis.py validates only the android:host value via valid_host(), but appends a separately supplied android:por...

CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...

EUVD-2025-8857

Malicious code in bioql PyPI...

MobSF vulnerability allows SSRF due to the allow_redirects=True parameter

Summary The fix for the "SSRF Vulnerability on assetlinkscheckactname, wellknowns" vulnerability could potentially be bypassed. Details Since the requests.get request in the checkurl method is specified as allowredirects=True, if "https://mydomain.com/.well-known/assetlinks.json" returns a 302...

CVE-2024-29190 MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in android:host, so requests can also ...