Improper Certificate Validation in OpenAlgo by MarketCalls
CVE-2026-120250

6MEDIUM

Key Information:

Vendor

Marketcalls

Status
Openalgo
Vendor
CVE Published:
1 November 2026

What is CVE-2026-120250?

OpenAlgo versions prior to 2.0.3.1 contain a vulnerability in the handling of TLS hostname and certificate checks for STARTTLS and SMTPS. This flaw allows network-positioned attackers to bypass security protocols by presenting forged certificates. Consequently, attackers can intercept SMTP credentials and disrupt email communication, including the potential interception of password-reset links, exposing users to unauthorized access.

Affected Version(s)

OpenAlgo 1.0.0.29 < 2.0.3.1

References

https://github.com/marketcalls/openalgo/commit/af5d5f2cc5...
patch
https://github.com/marketcalls/openalgo/blob/main/docs/re...
release-notes
https://github.com/marketcalls/openalgo/blob/96e5927e5adb...
technical-description

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tommaso Bona (ParzivalHack)
marketcalls
.