# CVE-2026-53407: Zoom Workplace improper authorization in custom URL scheme handler

Source: https://junglewise.ai/threats/cve-2026-53407-zoom-workplace-improper-authorization-in-custom-url-scheme  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-53407 · Severity: high · CVSS 8.1 · Published 2026-06-12

Zoom Workplace and Meeting SDK for Android and iOS contain a security flaw in how they handle custom web links. An attacker could use a specially crafted link to gain unauthorized privileges or access sensitive data within the app. This could lead to account compromise or unauthorized actions being performed on behalf of the user.

Technologies: [Zoom Meeting SDK](https://junglewise.ai/threats/technologies/meeting-sdk), [Zoom Workplace](https://junglewise.ai/threats/technologies/workplace). Vendors: [Zoom](https://junglewise.ai/threats/vendors/zoom).

## Quick answers

**Is CVE-2026-53407 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53407 being exploited in the wild.

**How severe is CVE-2026-53407?** High severity, with a CVSS score of 8.1, published 12 June 2026.

**Which products and versions are affected?** Zoom Meeting SDK before 7.0.4 (Android), before 7.0.3 (iOS); Zoom Workplace before 7.0.4 (Android), before 7.0.3 (iOS).

**Is there a fix for CVE-2026-53407?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53407 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53407?** Check whether you run Zoom Meeting SDK or Zoom Workplace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as Improper Authorization (CWE-939) exists in the custom URL scheme handler of Zoom's mobile applications. The root cause is insufficient validation of requests initiated via these schemes, which can be triggered by a remote attacker through network access (typically requiring user interaction like clicking a link). An unauthenticated attacker can exploit this to conduct an escalation of privilege, potentially gaining unauthorized access to application functions or data. The issue is resolved in Zoom Workplace for Android version 7.0.4 and iOS version 7.0.3, as well as corresponding Meeting SDK versions.

## Affected products

- Zoom Workplace before 7.0.4 (Android), before 7.0.3 (iOS)
- Zoom Meeting SDK before 7.0.4 (Android), before 7.0.3 (iOS)

## Timeline

- 2026-06-09: advisory: Initial publication by Zoom
- 2026-06-12: disclosed: NVD publication date

## References

- [https://www.zoom.com/en/trust/security-bulletin/zsb-26010](https://www.zoom.com/en/trust/security-bulletin/zsb-26010)

## Related threats

- [Zoom Clients use-after-free in annotator function](https://junglewise.ai/threats/cve-2026-53415-zoom-clients-use-after-free-in-annotator-function)
- [Zoom Workplace for Windows improper input validation account takeover](https://junglewise.ai/threats/cve-2026-53412-zoom-workplace-for-windows-improper-input-validation-account)
- [Zoom Workplace improper authorization in custom URL scheme handler](https://junglewise.ai/threats/cve-2026-53408-zoom-workplace-improper-authorization-in-custom-url-scheme)
- [Zoom Workplace for iOS protection mechanism failure](https://junglewise.ai/threats/cve-2026-30904-zoom-workplace-for-ios-protection-mechanism-failure)
- [Zoom Clients for Windows privilege escalation](https://junglewise.ai/threats/cve-2026-30902-zoom-clients-for-windows-privilege-escalation)