A plugin in Deepin Control Center was set to bypass TLS certificate verification when downloading a user’s avatar from online services, a certificate verification bypass weakness identified as CWE‑295. This flaw allows an attacker who can position themselves between the local machine and the avatar‑providing server to intercept the request and supply a malicious or misleading image, potentially misidentifying the user or delivering deceptive content.

The affected components are Deepin Desktop Environment’s control panel (dde-control-center) and the deepin-deepinid-plugin. Versions before 6.1.80 of dde-control-center and before 5.9.9 of the plugin contain the flaw.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be on a network path between the user’s machine and the avatar service, which is feasible on compromised or poorly secured networks. Once the TLS check is bypassed, the attacker can alter the avatar without detection, enabling user impersonation or deceptive imagery.