Creema Limited’s Handmade Marketplace App (iOS and Android) contains an open redirect vulnerability that allows an attacker to craft a URL which, when opened in the app, displays an attacker‑controlled website inside the app’s view. This can lead users to unknowingly provide credentials or other sensitive information to the attacker, resulting in a phishing compromise.

The affected products are the Creema "Handmade Marketplace App" for iOS and the "Handmade Marketplace App – Creema" for Android. No specific version numbers are listed in the available data, so any current installation that includes the open redirect code is potentially vulnerable.

The CVSS score of 5.1 reflects a moderate severity, the EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not recorded in the CISA KEV catalog. The attack vector appears to be user‑initiated, where a malicious link or QR code leads a user to the app with a crafted URL. Once the redirection occurs, the attacker can present a phishing site within the app, potentially affecting user confidentiality but not system integrity or availability.