Open Redirect Vulnerability in Handmade Marketplace App by CREEMA LTD
CVE-2026-72528

5.1MEDIUM

Key Information:

Vendor

Creema Ltd.

Status
"handmade Marketplace App - Creema" For Android
"creema - Handmade Marketplace App" For iOS
Vendor
CVE Published:
15 October 2026

What is CVE-2026-72528?

The Handmade Marketplace App by CREEMA LTD is affected by an open redirect vulnerability that could potentially expose users to phishing attacks. When a specially crafted URL is accessed, the app may redirect users to an attacker-controlled website, compromising the user's security. This vulnerability underscores the importance of implementing proper validation checks for URL redirects to protect users from potential threats.

Affected Version(s)

"Creema - Handmade Marketplace App" for iOS 0 < 2.432.0

"Handmade Marketplace App - Creema" for Android 0 < 2.436.0

References

https://play.google.com/store/apps/details?id=jp.creema.c...
https://apps.apple.com/jp/app/id916614208
https://jvn.jp/en/jp/JVN48627289/

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.