The vulnerability in YAMAP -Social Trekking GPS App arises from improper verification of the source of a communication channel within its WebView implementation. This flaw can cause the in-app browser to leak information from the app or redirect users to websites not intended by the app developers. The issue affects versions from 0 up to and including 17.1.0. The CVSS 3.0 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity, and no impact on availability.

Exploitation of this vulnerability could lead to partial information disclosure from the app and redirection of users to potentially malicious or unintended websites. This could compromise user privacy and trust but does not directly impact system availability or cause significant integrity loss.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with links within the app's WebView and avoid clicking suspicious links.