This vulnerability is caused by insufficient validation of user-supplied URLs. A malicious payload can be supplied from within the device, causing the application to open a URL scheme that launches any desired activity under Samsung Members' privileges. The attack remains confined to the application’s trust boundary and does not elevate privileges beyond those granted to Samsung Members.

Samsung Mobile's Samsung Members application, all versions prior to 5.8.01.5. The issue is local, affecting only devices that already have the vulnerable app installed.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of <1% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. The likely attack vector is local, requiring the attacker to have physical or local remote access to the device; no external network-based attack is noted in the description.