Low severity · published Oct 19, 2026
CVE-2026-112105
GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation
3.7
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/main.dart of the component TLS Handler. Such manipulation leads to improper certificate validation. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. Upgrading to version 1.10.2 is sufficient to fix this issue. The name of the patch is 3d48df7cce05e39fa4de1e42768492307f26882e. The affected component should be upgraded.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Passy · GlitterWare
1.10.0; 1.10.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112105
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112105
github.com
https://github.com/GlitterWare/Passy/
github.com
https://github.com/GlitterWare/Passy/commit/3d48df7cce05e39fa4de1e42768492307f26882e
github.com
https://github.com/GlitterWare/Passy/issues/210
github.com
https://github.com/GlitterWare/Passy/releases/tag/v1.10.2
vuldb.com
https://vuldb.com/cve/CVE-2026-112105
vuldb.com
https://vuldb.com/submit/1013135
More from Passy
9.1
CVE-2025-67397
An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection