CWE-939
Improper Authorization in Handler for Custom URL Scheme
The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
Impactr finds and proves whether CWE-939 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.