CVE-2026-50208
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES encryption keys, a Man-in-the-Middle attacker can decrypt network traffic.
Risk Assessment
An attacker can intercept and decrypt all network traffic, leading to data confidentiality breaches and potential theft of sensitive information.
Recommendation
Remove or replace TrustAllCerts routines with proper certificate validation. Use strong encryption algorithms (e.g., AES) and avoid hard-coded keys.
Other vulnerabilities in Unknown application
See all- CVE-2026-14953Medium
A low-privileged remote attacker can enumerate all configured users and identify accounts with elevated privileges using the endpoint /api/user/fetch-all.php.
- CVE-2026-14949Medium
A low-privileged remote attacker with a valid session can create new user accounts with arbitrary role values, including the highest privilege level, using the /api/user/add.php endpoint.
- CVE-2025-58581Medium
When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
- CVE-2025-58579Medium
Due to a lack of authentication, an unauthenticated user can request data from this endpoint, making the application vulnerable to user enumeration.
Original NVD description (English source)
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS