A flaw in diem project’s Google Analytics Client (gapi.class.php) allows improper certificate validation, which could enable an attacker to bypass TLS checks when communicating with Google Analytics. The vulnerability is considered remotely exploitable, requires high complexity, and a published exploit exists. Potential consequences include man‑in‑the‑middle attacks, credential theft, or data tampering.

The issue affects installations of the diem project software, specifically the Google Analytics Client component supplied via dmCorePlugin. Because the project follows a rolling release model, no explicit affected or fixed versions are listed; any build prior to a future fix may remain vulnerable.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is remote with a high complexity requirement, and exploitation is reported as difficult, but a publicly available exploit raises the risk for exposed endpoints relying on the client.