CVE-2026-68927

Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.5.1

Description An authenticated user can upload a crafted APK to trigger requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. This occurs because the get browsable activities function in mobsf/StaticAnalyzer/views/android/manifest analysis.py only validates the android:host value using valid host before appending a separately supplied android:port to the URL processed by check url. By using an attacker-controlled hostname and DNS rebinding—a technique where a DNS server changes the IP address of a domain between the time of validation and the time of connection—the request can reach an internal service, despite redirects being disabled and the path remaining fixed.

Recommendations Update to version 4.5.1.