A flaw in Moovit Bus & Public Transit App version 1.18 on Android allows a local attacker to manipulate requests that target the app’s custom URL scheme. The misuse of the com.tranzmate component bypasses the intended authorization checks, enabling an attacker to invoke privileged functionality or send commands that the application should reject.

The vulnerability affects Moovit Bus & Public Transit App, specifically version 1.18 on Android, where the defect resides in an unspecified part of the com.tranzmate component.

The CVSS score of 4.8 classifies this as a moderate severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating that no large‑scale exploitation has been reported. Nevertheless, a published exploit exists, and because the attack can only be carried out locally, the risk is constrained to scenarios where a malicious user has code running on the victim’s device or can trigger the custom URL scheme through a malicious app.