CVE-2025-65827
CRITICAL
INFO
Priority: 0.02
BB Relevance:
78/100
Published: 2025-12-10
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
None
Description
The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit. TThis may result in a total compromise of the user's account if the attacker intercepts a request with active authentication tokens or cracks the MD5 hash sent on login.
Weakness Classification (1)
References & Advisories (2)
Third Party Advisory
Third Party Advisory