The issue stems from OpenAlgo’s improper validation of TLS certificates for SMTP connections: STARTTLS and SMTPS calls are performed without hostname or certification checks. This flaw allows an attacker positioned on the same network to present a forged certificate, intercept SMTP credentials, and steal subsequent mail such as password‑reset links. The vulnerability directly undermines the confidentiality of authentication data and any information transmitted over email.

All OpenAlgo releases from 1.0.0.29 up to but excluding 2.0.3.1 are affected. The problem resides in the utils/email_utils.py and utils/email_debug.py modules distributed by marketcalls:OpenAlgo. Users of these specific versions that rely on SMTP for authentication or password reset functions are at risk.

The CVSS score of 6 indicates moderate severity. Although EPSS data is not available, the exploitation method only requires an attacker to be able to intercept SMTP traffic and to provide a forged certificate; no privileged access or complex prerequisites are needed. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known large‑scale exploitation yet, but the attack path is straightforward for a network‑positioned adversary and could compromise credentials and sensitive email content.