This vulnerability in Moovit Bus & Public Transit App 1.18 on Android allows local attackers with limited privileges to manipulate the handler for a custom URL scheme, resulting in improper authorization. The affected component is com.tranzmate. The exploit requires local access and no user interaction. The vendor was notified but did not provide any response or fix. No patch or official remediation is currently documented.

An attacker with local access and limited privileges could exploit this flaw to bypass authorization controls in the custom URL scheme handler. This may allow unauthorized actions within the app context. The impact is limited by the need for local access and the absence of user interaction requirements. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should limit local access to the device and avoid installing untrusted applications that could leverage this vulnerability.