PT-2025-50502 · Unknown · Mobile Application

Published 2025-12-10 · Updated 2025-12-14 · CVE-2025-65827

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mobile application (affected versions not specified)

Description The mobile application allows clear text traffic to all domains and communicates with an API server over HTTP. This allows an attacker positioned upstream to intercept and modify traffic, potentially compromising a user's account if active authentication tokens are intercepted or the MD5 hash sent during login is cracked. The API server is vulnerable to interception attacks due to the use of HTTP. The vulnerable parameters include authentication tokens and the MD5 hash used during login.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2025-65827

Affected Products

Mobile Application

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-65827 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65827 · Vendor Advisory
• https://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Mobile-Application/Clear-Text-Traffic-Enabled.md · Note
• https://twitter.com/CVEnew/status/2000248679278706992 · Twitter Post
• https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-clear-text-traffic-enabled-md · Note