Description

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708.

Related CPE's

Could not find any relations

References

https://cert.pl/posts/2026/10/CVE-2026-93570

https://www.elektronicznypodpis.pl/

Weaknesses

[email protected]

Primary
CWE-295

CVSS impact metrics

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

6.9 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-29T16:17:47.653Z

14 hours ago

Last modified

2026-10-29T16:30:07.917Z

14 hours ago