Weak TLS Certificate Pinning in Cyberduck and Mountain Duck

CVE-2025-41256

What is CVE-2025-41256?

Cyberduck and Mountain Duck suffer from a vulnerability related to improper handling of TLS certificate pinning. This issue arises because the software stores certificate fingerprints using the SHA-1 hash algorithm, which is recognized as weak and vulnerable to collision attacks. As a result, untrusted certificates, including self-signed ones, may be accepted without sufficient validation, exposing users to potential man-in-the-middle attacks and other security threats. It is essential for users to update to the latest versions to mitigate these risks.

References