CVE-2026-120250 | CVSS: 5.3 | 严重级别: MEDIUM
OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.
参考链接:
• https://github.com/marketcalls/openalgo
• https://github.com/marketcalls/openalgo/blob/96e5927e5adbff146f203bf72c7a79add9e
• https://github.com/marketcalls/openalgo/blob/main/docs/releases/version-2.0.3.1-
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。