NT OneAPP, developed by NewType Infortech, suffers from improper certificate validation allowing an attacker to forge the server certificate. The flaw means the application does not verify that the certificate presented by the server is valid or that the hostname matches, so any unauthorized party can intercept or manipulate traffic between the client and the server. This limitation directly affects confidentiality and integrity of data exchanged by the application, potentially enabling data theft, injection, or manipulation.

Affected are installations of NewType Infortech's NT OneAPP. The vulnerability is limited to versions that lack the vendor‑supplied certificate validation fix; the recommended patch is to upgrade to NT OneAPP version 1.5.35 or later. No specific build numbers beyond that have been identified in the CNA data.

The CVSS base score of 9.3 classifies this as a critical vulnerability. The EPSS score is not available, so the exploitation probability cannot be quantified, but the condition that an unauthenticated network‑adjacent attacker can manipulate handshakes implies that any device on the same physical or logical network could attempt a forgery. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors are local network connections to the server, where an attacker can perform a man‑in‑the‑middle by presenting a self‑signed certificate. The lack of hostname validation further lowers the barrier for exploitation.