CVE-2026-106036

Vulnerability Description

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708.

Related Weaknesses (CWE)

CWE-295

References

https://cert.pl/posts/2026/10/CVE-2026-93570
https://www.elektronicznypodpis.pl/

FAQ

What is CVE-2026-106036?

CVE-2026-106036 is a documented vulnerability. Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an ...

How severe is CVE-2026-106036?

CVSS scoring is not yet available for CVE-2026-106036. Check NVD for updates.

Is there a patch for CVE-2026-106036?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.