OpenAlgo CVE-2026-120250

The weakness is in OpenAlgo's shipped code, not a user toggle: utils/email_utils.py and utils/email_debug.py set check_hostname=False and verify_mode=CERT_NONE on both the STARTTLS and SMTPS (implicit TLS) paths, so every affected instance (1.0.0.29 up to before 2.0.3.1) that sends mail is exposed without any special configuration. Exploitation requires (1) the instance to have SMTP email configured and in use (e.g. for password-reset mail), and (2) the attacker to hold an active man-in-the-middle position on the network path between OpenAlgo and its mail server to present a forged certificate during the handshake - this positioning requirement (AV:A, AC:H, AT:P) is the primary limiting factor on real-world exploitation. No authentication or user interaction on the victim side is needed (PR:N/UI:N). Per the patch notes, a mail host entered as an IP address fails verification by design after the fix.

This is a medium-severity confidentiality issue (vendor CVSS 4.0 base 6.0), and the real-world signals are consistent with that rather than with an urgent emergency. The vulnerability requires an attacker who is already network-positioned between OpenAlgo and its mail server, reflected in AV:A (adjacent), AC:H (high complexity), and AT:P (a specific attack requirement - the attacker must intercept and present a forged certificate during the TLS handshake), with no privileges or user interaction needed (PR:N/UI:N). Impact is confidentiality-only (VC:H, VI:N/VA:N): interception of SMTP credentials and subsequent mail including password-reset links. No EPSS score is provided in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public exploit or PoC reference in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' which aligns with the moderate score and the need for a privileged network position - a genuine fix-this-cycle item but not a drop-everything emergency. The main caveat is that CVSS 4.0 was authored with AV:A, whereas a man-in-the-middle on an SMTP path can in some deployments be reachable remotely; defenders whose mail traffic crosses untrusted networks should treat the attack surface as broader than 'adjacent' implies.

An attacker able to intercept traffic on the network path between an OpenAlgo instance and its configured SMTP server (for example on a shared or untrusted network segment) presents a forged TLS certificate. Because the affected code sets check_hostname=False and CERT_NONE for both STARTTLS and SMTPS, OpenAlgo completes the handshake without validating the certificate and sends its SMTP username and password, allowing the attacker to capture credentials and all subsequent mail, including password-reset links. No public exploit code is identified in the available data, and the attack requires the attacker to be positioned on the connection path (AC:H/AT:P).