Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.
This issue was fixed in version 2.0 build 708.
This issue was fixed in version 2.0 build 708.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 29 Oct 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708. | |
| Title | Improper certificate validation in Szafir | |
| First Time appeared |
Krajowa Izba Rozliczeniowa
Krajowa Izba Rozliczeniowa szafir |
|
| Weaknesses | CWE-295 | |
| CPEs | cpe:2.3:a:krajowa_izba_rozliczeniowa:szafir:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Krajowa Izba Rozliczeniowa
Krajowa Izba Rozliczeniowa szafir |
|
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-10-29T15:08:02.788Z
Reserved: 2026-10-06T13:51:18.839Z
Link: CVE-2026-106036
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses