CVE-2025-65830CRITICAL 9.1EPSS p15.2%

CVE-2025-65830CVE-2025-65830

Description

Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt the TLS traffic, inspect its contents, and modify the requests in transit. This may result in a total compromise of the user's account if the attacker intercepts a request with active authentication tokens or cracks the MD5 hash sent on login.

Scoring

CVSS 3.19.1 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS0.24% probability of exploitation · percentile 15.2% · 2026-06-19T12:03:05Z
Published2025-12-10
Last modified2025-12-30

Underlying weaknesses· 1

CWE-295

References

  1. https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-lack-of-certificate-pinning-md
  2. https://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Mobile-Application/Lack-of-Certificate-Pinning.md

1

TypeTargetConfidenceTier
WeaknessImproper Certificate Validationcwe-2950%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-65827
CVE
CVE-2025-58587
CVE
CVE-2025-9293
CVE
CVE-2025-49196
CVE
CVE-2025-30023
CVE
CVE-2025-49199
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.