GlitterWare Passy CVE-2026-112105

Requires the attacker to hold an active machine-in-the-middle position on the network path between the Passy client (versions up to 1.10.1) and any host it contacts over HTTPS; the defect disables certificate validation globally via HttpOverrides.global, so any TLS connection the app makes is affected rather than one specific feature. Limiting factors that reduce realistic risk: the attacker must already control or intercept the network segment (public/shared Wi-Fi, compromised gateway, rogue AP) and actively perform TLS interception at the moment Passy connects - hence the vendor's HIGH complexity / 'difficult' rating. No authentication or user interaction on the target is needed (PR:N/UI:N), but no exploitation is possible without the on-path position.

This is a genuine but lower-tier priority. The source-code evidence confirms the root cause unambiguously: MyHttpOverrides in lib/main.dart set badCertificateCallback to always return true, globally disabling TLS certificate validation for all HttpClient connections (HttpOverrides.global). CWE-295 (improper certificate validation) is therefore vendor/commit-confirmed, not merely inferred. However, the real-world risk is constrained: the vendor-supplied CVSS:4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) and the description both emphasize HIGH attack complexity and 'difficult' exploitability, because exploitation requires an active machine-in-the-middle (MITM) position on the network path - a condition an attacker cannot create at will. Exploitation status is: no public exploit identified at time of analysis (reported by VulDB only; no POC, no CISA KEV entry, and no EPSS score were provided). A notable conflict exists between the signals: VulDB scored impact as VC:N/VI:L (no confidentiality impact, only low integrity) at 6.3 MEDIUM, yet the tag 'Information Disclosure' and the nature of the flaw (a password manager silently accepting forged certificates) point toward confidentiality exposure of synced data - these two signals disagree and should be verified against the actual data flows protected by TLS. Net: a real, confirmed hardening defect worth patching promptly for a sensitive app class (password manager), but not an emergency given high complexity, no known exploitation, and no POC.

An attacker positioned on the network path between a Passy instance and the server it connects to (e.g., on a shared/hostile Wi-Fi network or a compromised router) presents a forged or self-signed TLS certificate. Because badCertificateCallback unconditionally returns true, the Passy client accepts the invalid certificate without warning, letting the attacker decrypt and/or tamper with the transmitted data. No public exploit code was identified, and success requires the attacker to already hold a MITM position, consistent with the 'high complexity' rating.