MEDIUMCVSS 6.9

CVE-2026-106036

CVE-2026-106036 updated by NVD

Published: 2026-10-29
Modified: 2026-11-06
Sources: euvd, nvd

Summary

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-106036

Includes data from the ENISA EU Vulnerability Database (EUVD).

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.