Improper Certificate Validation in PUPnP - #VU161878
Published: November 8, 2026
Vulnerability identifier: #VU161878
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to intercept and alter HTTPS communications trusted by PUPnP applications.
The vulnerability exists due to missing certificate and hostname validation in the HTTPS client when an application built with UPNP_ENABLE_OPEN_SSL, which is disabled by default, fetches an HTTPS URL. An unauthenticated remote attacker can impersonate the server from an on-path position using a self-signed, hostname-mismatched certificate and supply attacker-controlled responses.
Affected software
PUPnP
Remediation
Install security update from vendor's website.
PUPnP - update to 22.2.0