CVE-2026-68927: MobSF has SSRF port restriction bypass in assetlinks_check
MobSF’s Android App Link assetlinks checker validates only the manifest android:host value with valid_host(), but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in valid_host() and lets a crafted APK cause MobSF to fetch http://host:<attacker-port>/.well-known/assetlinks.json or https://host:<attacker-port>/.well-known/assetlinks.json.
References
- github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf
- github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627
- github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1
- github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-95px-34x5-p37h
- github.com/advisories/GHSA-95px-34x5-p37h
- nvd.nist.gov/vuln/detail/CVE-2026-68927
Code Behaviors & Features
Detect and mitigate CVE-2026-68927 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →