cyfenced.com →

[ CVE-2026-120250 · Published 1 Nov 2026 ]

Vulnerability in marketcalls OpenAlgo

CVSS 5.3 EPSS <1%No fix listed yet

[ Description ]Official description

OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References