Description
Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server.
This issue was fixed in version 2.0 build 708.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Krajowa Izba Rozliczeniowa | Szafir | ≤ 2.0 | — |
References
- https://cert.pl/posts/2026/10/CVE-2026-93570 third-party-advisory
- https://www.elektronicznypodpis.pl/ product