Netmaker disables TLS certificate validation when connecting to a consumer SMTP server by setting the skip‑verify flag to true unconditionally. The assignment occurs immediately after a comment warning that the setting should be false in production, and no configuration value or alternative code path restores verification. This results in a CWE-295 vulnerability, where the SMTP client therefore accepts any certificate presented by the mail server, including one supplied by an attacker who can interpose between Netmaker and its mail relay. Emails sent by Netmaker in this configuration contain password‑reset messages with single‑use tokens and user invitation messages that include enrollment links; an attacker can read, alter, or capture those messages before the intended recipient does, compromising account credentials and allowing unauthorized access.

Netmaker versions up to and including 1.6.0 are affected; any release beyond 1.6.0 is not listed as vulnerable.

The CVSS score of 8.3 reflects high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑level man‑in‑the‑middle that can sit between Netmaker and its SMTP server and present a forged certificate. Because the code unconditionally disables verification and offers no configuration to re‑enable it, exploitation requires only the ability to insert an untrusted TLS session, which is feasible for an attacker who can intercept or alter network traffic. Given that password‑reset and invitation emails are critical to account security, the risk to confidentiality and integrity is substantial and demands prompt remediation.