CVE-2026-50208
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES encryption keys, a Man-in-the-Middle attacker can decrypt network traffic.
Risk Assessment
An attacker can intercept and decrypt all network traffic, leading to data confidentiality breaches and potential theft of sensitive information.
Recommendation
Remove or replace TrustAllCerts routines with proper certificate validation. Use strong encryption algorithms (e.g., AES) and avoid hard-coded keys.
Other vulnerabilities in Unknown application
See all- CVE-2026-14953Medium
A low-privileged remote attacker can enumerate all configured users and identify accounts with elevated privileges using the endpoint /api/user/fetch-all.php.
- CVE-2026-14949Medium
A low-privileged remote attacker with a valid session can create new user accounts with arbitrary role values, including the highest privilege level, using the /api/user/add.php endpoint.
Original NVD description (English source)
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS