Affected is the MyHttpOverrides function in lib/main.dart of the TLS Handler component of GlitterWare Passy. The function suppresses proper certificate validation, allowing an attacker to present a forged or self‑signed certificate and gain trust for the TLS connection. This flaw may lead to an attacker impersonating the target service and intercepting, modifying, or exfiltrating data, which can compromise confidentiality and integrity of the user’s stored secrets. The vulnerability is mapped to CWE‑287 and CWE‑295 and has a CVSS score of 6.3, indicating moderate severity.

GlitterWare Passy, a password management application, is affected in all releases up to and including version 1.10.1. The fix is included in release 1.10.2, which implements the proper certificate validation logic. Users should verify they are running a version newer than 1.10.1.

The CVE notes that the attack may be launched remotely, has a high complexity rating, and the exploitability is described as difficult. With no EPSS score available, the exact likelihood of exploitation is uncertain, but the problem is not currently listed in the CISA KEV catalog. An attacker would need to trigger the TLS flow from the client, supply a spoofed certificate, and observe the override logic allow the handshake. The attacker could then intercept traffic and gain access to stored credentials if the application accepts the forged certificate as trusted.