The vulnerability arises from improper authorization in the handler for custom URL schemes within the mobile_open_url tool of mobile-next's mobile-mcp server. Before version 0.0.50, the tool forwards user-supplied URLs directly to Android's intent system without validating the scheme, enabling execution of arbitrary intents. This can lead to unauthorized actions such as initiating phone calls, sending SMS messages, executing USSD codes, or accessing content providers. The issue is identified as CWE-939 (Improper Authorization). The vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity. The issue is resolved in version 0.0.50.

Exploitation of this vulnerability allows an attacker to execute arbitrary Android intents via crafted URLs, which can result in unauthorized phone calls, SMS messages, USSD code execution, and access to content providers. This can lead to information disclosure, unauthorized actions on the device, and potential denial of service. The CVSS score reflects high impact on integrity and availability, with limited confidentiality impact.

Upgrade mobile-next mobile-mcp to version 0.0.50 or later, where this vulnerability is fixed by proper validation of URL schemes before passing them to Android's intent system. Since the vendor has released a fixed version, applying this official update is the recommended remediation. There is no indication of temporary fixes or workarounds.