Improper input validation in CreditCardRegisterActivity of Samsung Checkout allows a local user to launch any activity with the app’s privileges. By exploiting this flaw, an attacker can execute arbitrary code or actions that normally require Samsung Checkout permissions, potentially accessing sensitive information or performing privileged operations on the device.

Samsung Mobile’s Samsung Checkout application, versions earlier than 5.1.03.1, installed on Android mobile devices.

The CVSS score of 5.1 classifies this vulnerability as moderate severity. EPSS data is not available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires local access to the device, the attacker must already have physical or device-level access; remote exploitation is not supported.