CVE-2026-72528
Received Received - Intake

Open Redirect Vulnerability in Handmade Marketplace App Creema

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: JPCERT/CC

Description
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-72528
EUVD
EUVD-2026-101940

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
CREEMA LTD. "Handmade Marketplace App - Creema" for Android 0
CREEMA LTD. "Creema - Handmade Marketplace App" for iOS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an open redirect flaw in the Handmade Marketplace App 'Creema' by CREEMA LTD. It allows attackers to craft malicious URLs that, when opened, display a phishing website within the app's interface. This could trick users into entering sensitive information on a fake but legitimate-looking page.

Detection Guidance

Detecting this open redirect vulnerability requires checking if the Creema app versions are outdated. For Android, check the app version in Settings > Apps > Creema and compare it to version 2.436.0 or later. For iOS, check the App Store updates for Creema and ensure it is version 2.432.0 or later.

Impact Analysis

If exploited, this vulnerability could lead to phishing attacks where users may unknowingly share personal or financial details with attackers. Users might also be redirected to malicious websites that install malware or steal credentials.

Mitigation Strategies

Immediately update the Creema app to the latest version (Android 2.436.0 or later, iOS 2.432.0 or later) from the official app store. Avoid clicking on suspicious links that may redirect to phishing sites within the app.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72528. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart