The Kura Sushi Official App accepts any server certificate during the push‑notification handshake, allowing an attacker on the transport path to intercept or alter notification data. The vulnerability enables eavesdropping, corruption, or spoofing of the incoming push stream, effectively compromising confidentiality and integrity of app communications. Based on the description, it is inferred that an adversary could modify message payloads or block legitimate notifications, potentially delivering malicious content or denying service to users.

The affected products are the Kura Sushi Official App for Android and iOS, distributed by EPG, Inc. No specific software versions are listed, so the risk applies to all versions of the app currently in use.

The CVSS score of 9.1 places the flaw in the critical range, indicating a high exploitation potential. The EPSS score is not available, so precise likelihood cannot be quantified, but the lack of a CISA KEV listing does not mitigate the inherent severity of a MITM bypass. The attack likely requires control of the communication channel (e.g., rogue Wi‑Fi hotspot or compromised device) and can be executed without user interaction, making it a practical threat to any device running the affected app.