CVE-2026-120250 in OpenAlgo
Summary
by MITRE • 11/01/2026
OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in OpenAlgo versions prior to 2.0.3.1 represents a critical failure in transport layer security implementation within the application's email handling utilities. Specifically located in utils/email_utils.py and utils/email_debug.py, this flaw involves the improper validation of TLS certificates during SMTP communications. The core technical issue stems from the configuration or coding logic that explicitly disables hostname verification and certificate chain validation when establishing secure connections via STARTTLS encryption or direct SMTPS protocols. By bypassing these standard cryptographic checks, the application fails to ensure that it is communicating with the intended mail server rather than an impersonating entity. This creates a fundamental breakdown in the authentication phase of the TLS handshake, allowing any network-positioned attacker capable of intercepting traffic to perform a man-in-the-middle attack without triggering security warnings or connection failures within the OpenAlgo application context.
From an operational perspective, this vulnerability exposes sensitive data transmission channels to interception and manipulation. Since SMTP credentials are transmitted in plaintext after authentication if not properly secured by valid TLS, attackers can capture usernames and passwords with ease. Furthermore, because all subsequent mail traffic is also susceptible to interception under these conditions, the confidentiality of email content is compromised. This includes highly sensitive information such as password-reset links, which are frequently used for account recovery processes. An attacker who intercepts a password reset link can hijack user accounts by resetting credentials and gaining unauthorized access. The impact extends beyond individual account compromise to potential organizational data breaches if administrative emails or internal communications containing confidential business intelligence are intercepted.
This vulnerability aligns with CWE-295, which describes Improper Certificate Validation, as the application does not properly verify that a presented certificate is valid for the host it claims to represent. Additionally, this flaw facilitates MITM attacks consistent with ATT&CK technique T1078, specifically relating to Valid Accounts and potentially T1557 if used to perform Adversary-in-the-Middle activities during credential theft or lateral movement via email interception. The severity is heightened by the fact that many developers may assume STARTTLS provides sufficient security without realizing that improper certificate validation renders the encryption useless against a determined adversary with network access, such as someone on the same local network segment or controlling an intermediate routing point.
To mitigate this risk, organizations running OpenAlgo versions before 2.0.3.1 must upgrade to version 2.0.3.1 or later where these validation checks have been restored and enforced correctly. For environments unable to immediately patch due to dependency constraints, it is advisable to restrict network access to the mail server using firewall rules that prevent unauthorized interception attempts, although this does not fully remediate the code-level flaw. Developers should also audit other parts of the application for similar patterns where TLS verification might be disabled for convenience during debugging or development and ensure these are strictly enabled in production environments. Regular security audits focusing on cryptographic implementations can help identify such misconfigurations before they lead to significant data breaches.