---
id: CVE-2026-68927
title: MobSF is a mobile application security testing tool used
summary: >-
  MobSF is a mobile application security testing tool used. Prior to 4.5.1,
  get_browsable_activities in
  mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an
  Android manifest android:host value with valid_host before ap…
severity: low
cvss: 3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N'
cwe:
  - CWE-918
vendor: mobsf
product: mobsf
affected:
  - mobsf < 4.5.1
patched:
  - mobsf 4.5.1
published: '2026-08-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68927'
references:
  - url: >-
      https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf
    label: security-advisories@github.com
  - url: 'https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627'
    label: security-advisories@github.com
  - url: >-
      https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1
    label: security-advisories@github.com
  - url: >-
      https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-95px-34x5-p37h
    label: security-advisories@github.com
  - url: >-
      https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-95px-34x5-p37h
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-95px-34x5-p37h'
tags:
  - nvd
  - ghsa
  - pip
epss: 0.00331
epssPercentile: 0.23523
aliases:
  - GHSA-95px-34x5-p37h
ecosystem: pip
ingestedAt: '2026-08-18T18:21:29.654Z'
---

## Overview

MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before appending a separately supplied android:port to the URL fetched by _check_url, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With an attacker-controlled hostname and DNS rebinding between validation and the requests.get connection, the request can reach an internal service, although redirects remain disabled and the path is fixed. This issue is fixed in version 4.5.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-68927)

Affected packages:

- `mobsf < 4.5.1`

Patched in:

- `mobsf 4.5.1`

Source: https://github.com/advisories/GHSA-95px-34x5-p37h