Cyber Resilience

CVE-2026-25060

Oplist Openlist ≤ 4.1.10

Published
02 February 2026
Modified
23 February 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0024 15th percentile
Risk Priority 58 floored blend · peak EPSS

Summary

CVE-2026-25060 is a high-severity Missing Validation of OpenSSL Certificate (CWE-599) vulnerability in Oplist Openlist. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-25060 affects OpenList Frontend, a UI component for OpenList, in versions prior to 4.1.10. The vulnerability stems from TLS certificate verification being disabled by default for all storage driver communications, as the TlsInsecureSkipVerify setting is set to true in the DefaultConfig() function within internal/conf/config.go. This misconfiguration allows connections without validating server certificates, exposing communications to interception. The issue is rated with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-599 (Missing Validation of OpenSSL Certificate).

Remote attackers with network access can exploit this vulnerability through man-in-the-middle (MitM) techniques, such as ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment, to redirect traffic to malicious endpoints. No privileges or user interaction are required, though the attack demands high complexity to position for interception. Successful exploitation enables full decryption, theft, and manipulation of storage operations, as the system establishes encrypted connections with attacker-controlled servers without security warnings.

The vulnerability is fixed in OpenList version 4.1.10. Mitigation involves upgrading to this release, as detailed in the GitHub commit (e3c664f81d0584fbbdb86ffe6644be16259371c1), release notes (v4.1.10), and security advisory (GHSA-wf93-3ghh-h389).

EU & UK References

Vulnerability Data

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go. This vulnerability enables Man-in-the-Middle (MitM)…

more

attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. This vulnerability is fixed in 4.1.10.

CWE(s)
CWE-599

Related Threats

MITRE ATT&CK Enterprise Techniques

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
T1557.002 ARP Cache Poisoning Credential Access
Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices.
attack.mitre.org →
T1557.003 DHCP Spoofing Credential Access
Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network.
attack.mitre.org →
T1557.004 Evil Twin Credential Access
Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-25059Same product: Oplist Openlist
CVE-2024-41265Shared CWE-599
CVE-2025-56230Shared CWE-599
CVE-2025-56232Shared CWE-599
CVE-2025-63432Shared CWE-599
CVE-2026-62657Shared CWE-599
CVE-2024-41253Shared CWE-599
CVE-2025-12553Shared CWE-599
CVE-2024-36755Shared CWE-599
CVE-2025-56146Shared CWE-599

Affected Assets

oplist
openlist
≤ 4.1.10

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V12.3.5
  • V17.2.8

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management partial match

Authenticator management requires verification of certificate identity and revocation status before use, directly stopping acceptance of unvalidated OpenSSL certificates.

SA-8 Security and Privacy Engineering Principles partial match

Security engineering principles require correct implementation of cryptographic authentication mechanisms including certificate validation.

SC-8 Transmission Confidentiality and Integrity partial match

Requiring cryptographic integrity protection for transmitted data forces proper certificate validation to establish trusted channels.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-02 full match
prevents

Proper data-in-transit protection via TLS requires certificate validation with SSL_get_verify_result().

PR.PS-06 mostly match
prevents

Secure development practices include implementing correct OpenSSL certificate validation during coding.

PR.AA-03 partial match
prevents

Service and hardware authentication depends on valid certificates, but the control is broader than TLS validation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing could detect missing certificate validation but does not prevent the weakness at development time.

A.8.24 Use of cryptography partial match
prevents

Mandates proper use of cryptography including certificate validation, directly addressing the missing SSL_get_verify_result() check.

A.8.26 Application security requirements partial match
prevents

Application security requirements may specify certificate validation but do not mandate the specific OpenSSL API usage.

A.8.28 Secure coding partial match
prevents

Requires secure coding practices that would include proper certificate validation in OpenSSL usage.

References