This vulnerability in Moovit Bus & Public Transit App 1.18 on Android allows an attacker with local access to manipulate the custom URL scheme handler in the com.tranzmate component, resulting in improper authorization. The issue does not require user interaction and has a CVSS 4.8 score indicating medium severity. The vendor was notified but has not provided any fix or advisory. No official remediation or patch is currently known.

An attacker with local access to the affected device can exploit this flaw to bypass authorization controls in the custom URL scheme handler of the app. This could potentially allow unauthorized actions within the app context. The impact is limited by the requirement for local access and the medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should limit local access to their devices and avoid executing untrusted custom URL schemes within the app until a fix is released.