CVE-2026-106036: Improper certificate validation in Szafir
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.
This issue was fixed in version 2.0 build 708.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Szafirto a version that resolves this vulnerability.Fixed in 2.0 build 708
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker who can intercept or redirect the application's HTTPS connection can present an arbitrary SSL/TLS certificate and impersonate the remote update server. No attacker authentication or user interaction is required according to the supplied severity vector.
Are default HTTPS protections sufficient?
No. The affected application accepts any client or server certificate and does not validate the certificate or hostname, so HTTPS connections do not authenticate the remote server.
What is the remediation?
Update Szafir to version 2.0 build 708 or later, where the issue is fixed.
What is the impact if exploitation succeeds?
The attacker can cause the application to download an update file from an attacker-controlled server. The provided vector indicates potential impact to confidentiality and integrity, but not availability.