---
id: "CVE-2026-121145"
kind: "vulnerability"
aliases: ["CVE-2026-121145"]
title: "iRA mobile apps: WebView URL checks let attackers steal bearer tokens"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Tata Motors iRA 2.0", "fixed": [], "affected": "<= 26.7.3", "ecosystem": "vendor"}, {"name": "Tata Motors iRA.ev", "fixed": [], "affected": "<= 26.7.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["android", "ios", "ira-app", "ira-ev", "mobile", "other", "tata-motors", "vehicle-services", "webview"]
not_affected_if: ["unknown"]
published_at: "2026-11-04T13:17:26+00:00"
first_seen_at: "2026-11-04T13:27:01+00:00"
updated_at: "2026-11-04T13:29:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121145", "first_seen_at": "2026-11-04T13:27:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T13:29:06+00:00"}]
---

# iRA mobile apps: WebView URL checks let attackers steal bearer tokens

The Tata Motors iRA 2.0 (26.7.3 and below) and iRA.ev (26.7.2 and below) apps do not properly validate URLs and origins in their WebView. Malicious web content sent to it could expose live bearer tokens and let an attacker impersonate the user on vehicle services.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Tata Motors iRA 2.0 affected <= 26.7.3 fixed ?
- vendor:Tata Motors iRA.ev affected <= 26.7.2 fixed ?

## How to check

Open the Tata Motors iRA 2.0 or iRA.ev app, check the version under app info or the store listing. Affected per the CVE record: iRA 2.0 version 26.7.3 or lower, iRA.ev version 26.7.2 or lower. The first fixed version is not published in the sources I could read.

## Timeline

- 2026-11-04T13:27:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121145
- 2026-11-04T13:29:06+00:00 analyst — No Tata/CERT-In advisory found; versions come from CNA data via OpenCVE (not primary, so nothing marked verified). Fixed version unknown; latest iRA.ev seen on a third-party mirror is 26.9.1 but not confirmed as the fix. No exploitation or PoC found. Settle by reading the CERT-In CIVN note or Tata's page.

## Documents

- [describes] OpenCVE: CVE-2026-121145 (CNA affected versions) https://app.opencve.io/cve/CVE-2026-121145

## From the sources

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView.

Successful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_