Auth bypass in Glitterware Passy
CVE-2026-112105
A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/main.dart of the component TLS Handler. Such manipulation leads to improper certificate validation. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. Upgrading to version 1.10.2 is sufficient to fix this issue. The name of the patch is 3d48df7cce05e39fa4de1e42768492307f26882e. The affected component should be upgraded.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Glitterware Passy — versions 1.10.0, 1.10.1
Weakness classification (CWE)
References
- vuldb.com/vuln/422055 (technical-description, vdb-entry)
- vuldb.com/vuln/422055/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-112105 (third-party-advisory)
- vuldb.com/submit/1013135 (third-party-advisory)
- github.com/GlitterWare/Passy/issues/210 (issue-tracking)
- github.com/GlitterWare/Passy/commit/3d48df7cce05e39fa4de1e42768492307f26882e (patch)
- github.com/GlitterWare/Passy/releases/tag/v1.10.2 (patch)
- github.com/GlitterWare/Passy/ (product)
Frequently asked questions
- What is CVE-2026-112105?
- CVE-2026-112105 is a low-severity vulnerability in Glitterware Passy, classified under Improper Authentication. CVSS score: 3.7/10. Published 2026-10-19.
- How severe is CVE-2026-112105?
- Low severity. CVSS v3 base score is 3.7 out of 10.