In the development build of the Eclipse aeriOS Federator component, outbound HTTPS requests are sent without validating the server’s TLS certificate unless the TLS_CERTIFICATE_VALIDATION environment variable is explicitly set to true. This default disables the standard security check that ensures the remote server is authentic, allowing an attacker who can observe or tamper with network traffic between the Federator and its external services to impersonate those services and capture encrypted data, including OAuth client credentials and bearer tokens. The vulnerability stems from improper certificate validation (CWE‑295).

The flaw exists in the Eclipse aeriOS Federator component running in the current development version, before any official release. No specific release or patch level is listed, so all developers using this pre‑release build are potentially affected.

The CVSS score of 8.3 classifies it as a high‑severity weakness. Exploitation requires the ability to intercept or manipulate network traffic between the Federator and the misconfigured external service; the attacker does not need to compromise the Federator itself. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The default misconfiguration makes the vulnerability broadly exploitable in environments where the Helm chart or Docker Compose deployment has not upgraded the TLS_CERTIFICATE_VALIDATION environment variable to true.