Insecure Data Transmission in Cryptomator by Liquiproof

CVE-2026-32309

What is CVE-2026-32309?

Cryptomator, a tool designed for encrypting files stored in cloud services, has a vulnerability that arises from its hub-based unlock flow prior to version 1.19.1. This flaw allows data to be transmitted over unencrypted HTTP, exposing sensitive information to active network attackers. Attackers can intercept or manipulate traffic, making it possible for them to compromise bearer tokens and key-loading credentials. Even though the vault key is protected on the device, the lack of enforced HTTPS on endpoints creates significant security risks. The issue has been addressed in the 1.19.1 release, reinforcing the importance of updating to this version to ensure secure data handling.

References