CVE-2024-41955 json
Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect
published 2024-07-31 2 y ago modified 2026-07-07 4 mo ago also EUVD-2024-2299 , GHSA-8m9j-2f32-2vx4 , PYSEC-2026-1669
- cvss
- 5.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.
Patch / fix
- pypi mobsf 4.0.5
- opensecurity mobile_security_framework 4.0.5
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.00% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Open Redirect in Login Redirect - MobSF nuclei detection template
- github.com https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8m9j-2f32-2vx4 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N |
| GitHub | 3.1 | 5.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 5.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mobsf | <4.0.5 |
4.0.5 |
Affected products
- MobSF Mobile-Security-Framework-MobSF
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8
web, patch
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8m9j-2f32-2vx4
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-41955
advisory
-
github.com
/MobSF/Mobile-Security-Framework-MobSF
package
-
pypi.org
/project/mobsf
package
-
github.com
/advisories/GHSA-8m9j-2f32-2vx4
advisory
Sources
- CVE List CVE-2024-41955
- GitHub Advisory GHSA-8m9j-2f32-2vx4
- NVD CVE-2024-41955
- OSV PYSEC-2026-1669
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.