{"id":"CVE-2026-121145","kind":"vulnerability","aliases":["CVE-2026-121145"],"related":[],"title":"iRA mobile apps: WebView URL checks let attackers steal bearer tokens","description":"This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView.\n\nSuccessful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.","summary":"The Tata Motors iRA 2.0 (26.7.3 and below) and iRA.ev (26.7.2 and below) apps do not properly validate URLs and origins in their WebView. Malicious web content sent to it could expose live bearer tokens and let an attacker impersonate the user on vehicle services.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tata Motors iRA 2.0","fixed":[],"affected":"<= 26.7.3","ecosystem":"vendor"},{"name":"Tata Motors iRA.ev","fixed":[],"affected":"<= 26.7.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","ios","ira-app","ira-ev","mobile","other","tata-motors","vehicle-services","webview"],"not_affected_if":["unknown"],"how_to_check":"Open the Tata Motors iRA 2.0 or iRA.ev app, check the version under app info or the store listing. Affected per the CVE record: iRA 2.0 version 26.7.3 or lower, iRA.ev version 26.7.2 or lower. The first fixed version is not published in the sources I could read.","fix":null,"status":"open","published_at":"2026-11-04T13:17:26+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","triaged_at":"2026-11-04T13:28:00+00:00","updated_at":"2026-11-04T13:29:06+00:00","category":"other","confidence":0.55,"triage":{"at":"2026-11-04T13:28:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"iRA mobile apps: WebView URL checks let attackers steal bearer tokens","impact":"high","summary":"The iRA 2.0 and iRA.ev mobile apps do not properly validate URLs and origins loaded in their WebView component. A remote attacker who gets malicious web content into that WebView can obtain live bearer authentication tokens and impersonate the user to reach vehicle-related services.","audience":"everyone","category":"other","nicknames":[],"who_cares":["ira-app","ira-ev","mobile","webview","vehicle-services"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Bearer tokens stolen; user impersonated; vehicle services accessed","analyst_note":"Find the vendor advisory and the affected and fixed app versions; NVD entry lacks version ranges and fix details.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Users of the iRA 2.0 and iRA.ev mobile applications, which load web content in a WebView. The sources do not say which versions are affected or whether a fix has shipped, so check the app store listing and the vendor for updates.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4193,"output_tokens":476,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the affected and fixed app versions; NVD entry lacks version ranges and fix details.","search":"'-121145':14A,17A '-2026':13A,16A '2.0':21A,46B,93C '26.7.2':52B '26.7.3':47B 'access':155C 'affect':125C 'allow':133C 'android':25B 'app':3A,29B,55B 'applic':97C,141C 'associ':152C 'attack':8A,80B,113C,135C 'authent':146C 'bearer':10A,75B,145C 'check':6A 'compon':110C 'content':68B,122C 'could':72B,114C,132C 'cve':12A,15A 'due':98C 'ev':32B 'exist':89C 'exploit':115C,128C 'expos':73B 'function':142C 'imperson':81B,150C 'inform':158C 'insuffici':100C 'interact':139C 'io':26B 'ira':1A,20A,28B,31B,45B,92C 'ira-app':27B 'ira-ev':30B 'ira.ev':24A,51B,95C 'let':7A,78B 'live':74B,144C 'load':106C 'malici':66B,120C 'mobil':2A,33B,96C 'motor':37B,44B 'motors':19A,23A 'obtain':143C 'origin':62B,105C 'perform':137C 'potenti':149C 'proper':58B 'relat':157C 'remot':112C 'send':119C 'sent':69B 'servic':40B,86B,160C 'steal':9A 'success':127C 'tata':18A,22A,36B,43B 'tata-motor':35B 'token':11A,76B,147C 'unauthor':138C 'url':5A,60B,103C 'user':83B,153C 'valid':59B,101C 'vehicl':39B,85B,156C 'vehicle-servic':38B 'vulner':88C,117C,131C 'web':67B,121C 'webview':4A,41B,65B,109C,126C 'within':107C","nicknames":[],"mitigations":[],"who_affected":"Owners using the Tata Motors iRA 2.0 (up to 26.7.3) or iRA.ev (up to 26.7.2) mobile apps. The apps do not properly validate URLs and origins loaded in their WebView, so malicious web content sent to it could expose a live bearer token and let an attacker act as the user on vehicle services. Users on newer versions are listed as unaffected by the CVE record; no exploitation is reported.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":["motorsira20","motorsiraev","tatamotorsira20","tatamotorsiraev"],"ptokens":["ev","ira","motors","tata"],"labels":["android","high","ios","iraapp","iraev","mobile","other","tatamotors","vehicleservices","webview"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vdisclose@cert-in.org.in","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121145","severity":null,"published_at":"2026-11-04T13:17:26+00:00","modified_at":"2026-11-04T13:17:26+00:00","first_seen_at":"2026-11-04T13:27:01+00:00","fetched_at":"2026-11-04T13:27:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121145:1669","url":null,"severity":null,"published_at":"2026-11-04T13:29:06+00:00","modified_at":"2026-11-04T13:29:06+00:00","first_seen_at":"2026-11-04T13:29:06+00:00","fetched_at":"2026-11-04T13:29:06+00:00","note":"No Tata/CERT-In advisory found; versions come from CNA data via OpenCVE (not primary, so nothing marked verified). Fixed version unknown; latest iRA.ev seen on a third-party mirror is 26.9.1 but not confirmed as the fix. No exploitation or PoC found. Settle by reading the CERT-In CIVN note or Tata's page."}],"documents":[{"id":67238,"url":"https://app.opencve.io/cve/CVE-2026-121145","title":"OpenCVE: CVE-2026-121145 (CNA affected versions)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}