Cryptomator 1.19.1 contains a logic flaw in the CheckHostTrustController.getAuthority() method that hardcodes the URI scheme based on port number. This flaw causes HTTPS URLs using port 80 to be treated the same as HTTP URLs, effectively bypassing consistency checks and the HTTP block validation. An attacker who can modify a vault.cryptomator file can craft a Hub configuration where the apiBaseUrl and authEndpoint use HTTPS on port 80 to pass auto‑trust validation while the tokenEndpoint uses plain HTTP. The vault is automatically trusted without user consent, allowing a network‑positioned attacker to intercept the OAuth token exchange and gain unauthorized access to the Cryptomator Hub API as the victim.

Cryptomator version 1.19.1 is affected; the issue is fixed in version 1.19.2. No other vendors or products are listed.

The vulnerability carries a CVSS score of 4.8 (moderate). EPSS is not available and the vulnerability is not in the CISA KEV catalog. Exploitation requires an attacker with write access to a cloud‑synced vault.cryptomator file, which can be achieved if the file is accessible to untrusted parties. The attack is thus limited to environments where such file modification is possible, and no remote code execution is directly achieved. The overall risk is moderate, with a realistic threat from compromised or poorly secured cloud storage.