PT-2025-50538 · Unknown · Mobile Application

Published 2025-12-10 · Updated 2025-12-30 · CVE-2025-65830

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mobile application (affected versions not specified)

Description A missing certificate validation allows an attacker positioned upstream to intercept and decrypt TLS traffic from the mobile application. This interception enables the attacker to inspect and modify requests in transit, potentially leading to a full compromise of a user's account if authentication tokens are captured or the MD5 hash sent during login is cracked.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2025-65830

Affected Products

Mobile Application

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-65830 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65830 · Vendor Advisory
• https://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Mobile-Application/Lack-of-Certificate-Pinning.md · Note
• https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-lack-of-certificate-pinning-md · Note
• https://t.me/cveNotify/147193 · Telegram Post
• https://twitter.com/CVEnew/status/2000248682604867871 · Twitter Post