CVE-2026-112105 Details
Description
A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/main.dart of the component TLS Handler. Such manipulation leads to improper certificate validation. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. Upgrading to version 1.10.2 is sufficient to fix this issue. The name of the patch is 3d48df7cce05e39fa4de1e42768492307f26882e. The affected component should be upgraded.
A vulnerability exists in GlitterWare Passy versions prior to 1.10.1, specifically within the TLS Handler component. The issue arises in the MyHttpOverrides function, where the application improperly validates TLS certificates by allowing all certificates to be accepted without verification. This flaw can be exploited remotely, creating a potential man-in-the-middle (MITM) attack vector, particularly for users of Passy Cloud synchronization. However, it's important to note that while this vulnerability could expose synchronized data and passwords to interception, all client data remains encrypted, and Passy Cloud servers do not decrypt this information.
Users should upgrade to GlitterWare Passy version 1.10.2, where this vulnerability has been addressed by re-enabling proper TLS certificate validation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GlitterWare/Passy/ | [email protected] | ProductVendor |
| https://github.com/GlitterWare/Passy/commit/3d48df7cce05e39fa4de1e42768492307f26882e | [email protected] | Source CodeVendor |
| https://github.com/GlitterWare/Passy/issues/210 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/GlitterWare/Passy/releases/tag/v1.10.2 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-112105 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1013135 | [email protected] | Permission Required |
| https://vuldb.com/vuln/422055 | [email protected] | Permission Required |
| https://vuldb.com/vuln/422055/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GlitterWare Passy | <= 1.10.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |