CVE-2026-120250 — Vulnerability intelligence
—
Published:
- CVSS
- 6
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.