Improper Certificate Validation in NT OneAPP by NewType Infortech
CVE-2026-114220

9.3CRITICAL

Key Information:

Vendor

Newtype Infortech

Status
Nt Oneapp
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114220?

NT OneAPP, developed by NewType Infortech, is vulnerable to improper certificate validation, allowing unauthenticated network-adjacent attackers to conduct man-in-the-middle attacks. By failing to validate the server certificate and hostname, attackers can potentially intercept and modify communications between the application and the server, compromising sensitive data integrity and availability.

Affected Version(s)

NT OneAPP 0 <= 1.5.22

References

https://www.twcert.org.tw/en/cp-139-11299-0cbfd-2.html
https://www.twcert.org.tw/tw/cp-132-11298-d9dd5-1.html

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.