Published:2026/10/15  Last Updated:2026/10/15

JVN#48627289
"Handmade Marketplace App - Creema" vulnerable to open redirect

Overview

"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability.

Products Affected

  • "Handmade Marketplace App - Creema" for Android versions prior to 2.436.0
  • "Creema - Handmade Marketplace App" for iOS versions prior to 2.432.0

Description

"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains the following vulnerability.

  • Open redirect (CWE-601)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 5.1
    • CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score 4.3
    • CVE-2026-72528

Impact

When accessing a specially crafted URL on a web browser, Creema app is invoked and a website set up by the attacker may be displayed within the app's screen. As a result, the user may become a victim of a phishing attack.

Solution

Update the Application
Update the application to the latest version according to the information provided by the developer.

Vendor Status

Vendor Link
CREEMA LTD. Handmade Marketplace App - Creema - Google Play (Text in Japanese)
Creema - Handmade Marketplace App - App Store (Text in Japanese)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Koki Sato of BroadBand Security, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-72528
JVN iPedia JVNDB-2026-000117