PT-2019-10014 · Square+1 · Okhttp+1

Published 2019-04-18 · Updated 2026-05-18 · CVE-2018-20200

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: OkHttp versions 3.x through 3.12.0

Description: The issue in OkHttp allows man-in-the-middle attackers to bypass certificate pinning. This is achieved by changing SSLContext and boolean values while hooking the application.

Recommendations: For OkHttp versions 3.x through 3.12.0, consider updating to a version where this issue is addressed, if available. As a temporary workaround, restrict modifications to SSLContext to prevent bypassing certificate pinning.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CLEANSTART-2026-KU61465

CLEANSTART-2026-LE11246

CLEANSTART-2026-RN56220

CVE-2018-20200

Affected Products

Debian

Okhttp

References · 199

• 🔥 https://cxsecurity.com/issue/WLB-2018120252 · Exploit
• https://github.com/square/okhttp/commits/master · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-0341 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1320 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41973 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-55163 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46120 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42587 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-20200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67735 · Security Note
• https://osv.dev/vulnerability/CVE-2018-20200 · Vendor Advisory