CVE-2026-92862: Improper authorization in handler for custom URL scheme in Wavedash Co., Ltd. Ticket Ryutsu Center
Description
The Android application "Ticket Ryutsu Center" by Wavedash Co., Ltd. has an improper authorization vulnerability in its handling of custom URL schemes. This flaw allows a malicious application to trigger access to arbitrary websites via crafted Intents. The vulnerability affects versions from 0 up to and including 4.1.9. The CVSS score is 3.3, indicating a low severity issue with limited impact on integrity and no impact on confidentiality or availability.
CVSS v3.0
Score 3.3low
Affected software
Wavedash Co., Ltd.
Ticket Ryutsu Center
pkg:apk/alpine/ticket-ryutsu-centerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92862 describes an improper authorization vulnerability in the Android app "Ticket Ryutsu Center" by Wavedash Co., Ltd. The app improperly handles custom URL schemes, which can be exploited by a malicious app to cause the vulnerable app to access arbitrary websites through crafted Intents. This could potentially lead to limited integrity impact but does not affect confidentiality or availability. The vulnerability affects versions >=0 and <=4.1.9.
Potential Impact
The vulnerability allows a malicious application to cause the affected app to access arbitrary websites via crafted Intents, potentially leading to limited integrity impact. There is no impact on confidentiality or availability. The overall severity is low as per the CVSS score of 3.3.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when installing untrusted applications that might exploit this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- jpcert
- Date Reserved
- 2026-09-17T06:02:21.902Z
- Cvss Version
- 3.0
- State
- PUBLISHED
Threat ID: 6ac7081d2cdf04f656d93c7a
Added to database: 10/08/2026, 03:03:57 UTC
Last enriched: 10/08/2026, 03:18:15 UTC
Last updated: 10/08/2026, 03:18:58 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.