THREAT OPS › Threat News › [GHSA] GHSA-95px-34x5-p37h (low) — MobSF has SSRF port restriction bypass in assetlinks_check
[GHSA] GHSA-95px-34x5-p37h (low) — MobSF has SSRF port restriction bypass in assetlinks_check
GHSA-95px-34x5-p37h Severity: low CVE: CVE-2026-68927
MobSF has SSRF port restriction bypass in assetlinks_check
## Summary
MobSF's Android App Link assetlinks checker validates only the manifest `android:host` value with `valid_host()`, but then appends the separate `android:port` value into the URL used for the server-side request. This bypasses the current port restriction in `valid_host()`
Indicators of compromise
- CVE-2026-68927cve
- http://host:url
- https://host:url
- http://rebind.example:22/.well-known/assetlinks.jsonurl
- http://rebind.exampleurl
Original source: https://github.com/advisories/GHSA-95px-34x5-p37h