| Title | GlitterWare Passy 1.9.0 - 1.10.1 Information Disclosure |
|---|
| Description | Passy (GlitterWare/Passy, a password manager application) disabled TLS certificate verification for all outbound HTTPS connections from v1.9.0 through v1.10.1 (CWE-295). The MyHttpOverrides class overrode the connection validator to accept any certificate, applied globally to the app's HTTP client. Version boundary established by tag bisection: v1.8.0 does not contain the pattern; v1.9.0 (2025-02-17) introduced it.
Fix: commit 3d48df7 (2026-07-26) deletes the MyHttpOverrides class entirely; the maintainer acknowledged twice ("hotfix" -> "Resolved in v1.10.2"); v1.10.2 released 2026-08-05.
Honest mitigation note: the password vault uses a zero-knowledge architecture, so an on-path observer sees only ciphertext; the exposure is transport integrity, downgrade of the sync channel and metadata, not plaintext secrets. CVSS v3.1: 6.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N), calibrated down from the standard CWE-295 vector to reflect the zero-knowledge mitigation.
No prior CVE exists for GlitterWare/Passy. |
|---|
| Source | ⚠️ https://github.com/GlitterWare/Passy/issues/210 |
|---|
| User | NeoWSY (UID 82976) |
|---|
| Submission | 10/04/2026 15:44 (28 days ago) |
|---|
| Moderation | 10/18/2026 19:59 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422055 [GlitterWare Passy up to 1.10.1 TLS lib/main.dart MyHttpOverrides certificate validation] |
|---|
| Points | 20 |
|---|