A flaw in Cryptomator for iOS allows an attacker to modify the vault configuration file because the integrity check is missing. The tampered file points the client to a malicious Hub API endpoint without validating the host, enabling a man‑in‑the‑middle attack that can steal authentication tokens. This leads to unauthorized access to vault contents and possible credential theft.

Cryptomator iOS clients before version 2.8.3. Users who unlock Hub‑backed vaults on iOS devices with these versions in environments where an attacker can alter the vault.cryptomator file. The vulnerability applies to all iPhone OS versions that run the affected app.

The CVSS score is 7.6, indicating a high severity. EPSS is below 1%, suggesting a low current probability of exploitation. The issue is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be able to modify the vault configuration file, which could occur through local device compromise, a malicious installer, or remote file manipulation if the vault is stored on shared media. Once the file is altered, the iOS client trusts the rogue endpoint and can expose tokens, effectively performing a MITM. The likely attack vector is tampering with the vault file prior to use; no additional network privilege is required.