CVE-2026-12189 Overview
CVE-2026-12189 is an improper authorization vulnerability [CWE-285] in the Moovit Bus & Public Transit App version 1.18 for Android. The flaw resides in the com.tranzmate component and affects the handler for a custom URL scheme. A locally positioned attacker can manipulate the handler to bypass authorization checks within the mobile application. Public exploit material has been released, and the vendor did not respond to early disclosure attempts.
Critical Impact
A local attacker on an Android device running Moovit 1.18 can invoke the custom URL scheme handler in com.tranzmate to bypass authorization, with limited impact to confidentiality, integrity, and availability.
Affected Products
- Moovit Bus & Public Transit App 1.18 for Android
- Component: com.tranzmate
- Custom URL scheme handler within the app
Discovery Timeline
- 2026-06-14 - CVE-2026-12189 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-12189
Vulnerability Analysis
The vulnerability stems from improper authorization in the handler that processes the application's custom URL scheme. Android allows apps to register custom schemes so external components, browsers, or other apps can deep-link into specific activities. When such handlers do not validate the caller's identity or the requested action, they expose internal functionality to any local context that can craft an intent.
In Moovit 1.18, the com.tranzmate component accepts crafted URI input through this handler without sufficient authorization checks. The result is access to behaviors or data paths that the app should restrict. Exploitation requires local access and minimal privileges, and the impact is limited in scope based on the CVSS 4.0 metrics published with the CVE.
Root Cause
The root cause is missing or insufficient authorization logic in the custom URL scheme handler [CWE-285]. The handler trusts incoming URI parameters and does not verify whether the invoking caller is permitted to trigger the underlying action. This is a common pattern in Android deep-link vulnerabilities where exported components or scheme handlers lack a permission check or signature verification.
Attack Vector
The attack vector is local. An attacker requires a presence on the Android device, either through a co-installed malicious app or interaction that can issue an intent to the Moovit handler. The malicious component crafts a URI targeting the registered scheme and passes parameters that the handler accepts without validating the caller. Publicly available exploit material referenced in VulDB and a GitHub repository demonstrates the technique.
No verified code example is available. Refer to the GitHub Repository for MOOVIT CVE and the VulDB CVE-2026-12189 entry for technical details.
Detection Methods for CVE-2026-12189
Indicators of Compromise
- Presence of Moovit Bus & Public Transit App version 1.18 on managed Android devices.
- Co-installed applications that issue intents targeting the com.tranzmate package or its registered custom URL scheme.
- Unexpected deep-link invocations recorded in Android logs referencing the Moovit scheme handler.
Detection Strategies
- Inventory mobile endpoints to identify devices running Moovit 1.18 and flag them for update or removal.
- Inspect installed Android packages for components that programmatically issue intents to com.tranzmate without user interaction.
- Review mobile threat defense telemetry for anomalous inter-app communication patterns involving public transit applications.
Monitoring Recommendations
- Monitor enterprise mobility management (EMM/MDM) inventories for the vulnerable Moovit version.
- Alert on installation of unvetted third-party APKs on devices that also have Moovit installed.
- Track vendor and VulDB advisories for an official patched release of Moovit on Android.
How to Mitigate CVE-2026-12189
Immediate Actions Required
- Update Moovit Bus & Public Transit App to a version later than 1.18 once a fix is published by the vendor.
- On managed devices, restrict or remove Moovit 1.18 until an updated build is available.
- Limit installation of untrusted third-party Android applications that could invoke the vulnerable handler locally.
Patch Information
At the time of publication, the vendor did not respond to disclosure attempts and no official patch reference is listed in the CVE record. Administrators should monitor the VulDB CVE-2026-12189 entry and the Google Play listing for Moovit for a corrected release.
Workarounds
- Enforce a mobile application allowlist via MDM and exclude Moovit 1.18 from approved builds.
- Educate users on the risk of installing untrusted apps on devices that also run public transit applications.
- Where the app is non-essential, uninstall Moovit until the vendor releases a fixed version.
No configuration-level mitigation is available for end users because the flaw is in the application's handler logic. Application-level remediation requires a vendor update.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
