CVE-2025-44017: Gunosy App Information Disclosure Flaw

CVE-2025-44017 Overview

CVE-2025-44017 affects the Gunosy mobile application, a Japanese news aggregation app. The vulnerability allows sensitive information to be included in the application's outbound network communication. An attacker who convinces a user to access a crafted URL can obtain the user's JSON Web Token (JWT).

The issue is categorized under [CWE-201] Insertion of Sensitive Information Into Sent Data. Exploitation requires user interaction, specifically that the victim opens a malicious URL. Once the JWT is captured, an attacker can impersonate the user against Gunosy backend services.

Critical Impact

A crafted URL can trigger the Gunosy app to leak the user's JWT to an attacker-controlled destination, enabling account impersonation.

Affected Products

• Gunosy App (mobile client)
• Versions prior to the vendor's remediated release (see JVN advisory)
• Users authenticated to Gunosy services via JWT

Discovery Timeline

• 2025-09-02 - CVE-2025-44017 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-44017

Vulnerability Analysis

The Gunosy application transmits sensitive authentication material in outbound requests without adequate scoping. When the app processes a specifically crafted URL, it includes the user's JWT in a request directed to a destination the attacker controls or observes. The JWT is a bearer credential that authenticates API calls on behalf of the user.

Exploitation requires the victim to interact with the crafted URL, typically through a phishing message, malicious webpage, or embedded link in another application. No authentication or elevated privileges are required on the attacker's side. The attack takes place over the network and does not require local access to the device.

Once captured, the JWT allows the attacker to issue authenticated API requests as the victim until the token expires or is revoked. Depending on the token's scope, this can expose personal data, reading history, and account settings tied to the Gunosy account.

Root Cause

The root cause is improper handling of outbound request destinations combined with insufficient scoping of authentication headers. The application attaches the JWT to requests that should not carry it, matching the [CWE-201] pattern of inserting sensitive information into transmitted data.

Attack Vector

An attacker crafts a URL designed to be processed by the Gunosy app. The attacker delivers the URL through email, social media, messaging, or a compromised web page. When the victim opens the link and the Gunosy app handles it, the app issues an outbound request that includes the victim's JWT. The attacker collects the token from the resulting request logs.

The vulnerability is described in prose only; no verified public proof-of-concept code is available. See the JVN Security Advisory for vendor-provided details.

Detection Methods for CVE-2025-44017

Indicators of Compromise

• Outbound HTTP or HTTPS requests from the Gunosy app carrying Authorization: Bearer headers to destinations outside Gunosy's known API domains.
• Unexpected API activity on a user's Gunosy account originating from IP addresses that do not match the user's device.
• Mobile device logs showing the Gunosy app resolving unusual URLs shortly before authentication anomalies.

Detection Strategies

• Inspect mobile network traffic through an enterprise mobile threat defense solution for JWT tokens sent to non-Gunosy endpoints.
• Correlate URL-open events on managed mobile devices with subsequent outbound requests carrying bearer tokens.
• Alert on Gunosy API sessions where the client-side IP or user agent changes abruptly during a short window.

Monitoring Recommendations

• Log deep-link and universal-link handling events on mobile devices where the Gunosy app is installed.
• Monitor egress proxy logs for requests to unfamiliar hosts that include long JWT-formatted bearer values.
• Track authentication events at Gunosy backend integrations for tokens reused from geographically inconsistent locations.

How to Mitigate CVE-2025-44017

Immediate Actions Required

• Update the Gunosy app to the latest version distributed through Google Play or the App Store.
• Instruct users to avoid opening Gunosy-related links from untrusted messages until the update is applied.
• Invalidate existing Gunosy sessions and require re-authentication for users on vulnerable app versions.

Patch Information

Refer to the JVN Security Advisory JVN47404248 for the vendor-supplied fixed version and release notes. Users should install the patched release from the official application store. No CPE entries are published in NVD for this CVE at the time of writing.

Workarounds

• Restrict handling of Gunosy deep links on managed mobile devices through mobile device management policies until patched.
• Educate users to open Gunosy content directly within the app rather than through third-party links.
• Rotate JWT signing keys on the backend where feasible to invalidate any tokens already exfiltrated.

# Verify Gunosy app version on an Android device (via adb)
adb shell dumpsys package com.gunosy.android | grep versionName