Improper Authorization Vulnerability in GEO Corporation's GEA App
CVE-2026-96614

5.1MEDIUM

Key Information:

Vendor

Geo Corporation

Status
"γ‚²γ‚ͺγ‚’γƒ—γƒͺ" For Android
"γ‚²γ‚ͺγ‚’γƒ—γƒͺ" For iOS
Vendor
CVE Published:
15 October 2026

What is CVE-2026-96614?

The GEA App, developed by GEO Corporation, is susceptible to improper authorization due to a flaw in the handler for its custom URL scheme. This vulnerability allows attackers to leverage the app's in-app browser to redirect users to arbitrary websites. Consequently, this could lead to potential phishing attacks and unauthorized disclosure of a user's session ID, putting sensitive information at risk.

Affected Version(s)

"γ‚²γ‚ͺγ‚’γƒ—γƒͺ" for Android 0 <= 11.8.6

"γ‚²γ‚ͺγ‚’γƒ—γƒͺ" for iOS 0 <= 11.8.6

References

https://play.google.com/store/apps/details?id=jp.co.geoon...
https://apps.apple.com/jp/app/id590190880
https://jvn.jp/en/jp/JVN40460777/

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.