Logic Flaw in Cryptomator's Security Handling for Cloud Storage

CVE-2026-33472

What is CVE-2026-33472?

Cryptomator, an open-source client-side encryption tool for cloud storage, has a logic flaw in the CheckHostTrustController.getAuthority() method. This flaw is present in version 1.19.1, allowing attackers to bypass important security measures established in a related vulnerability. The method's hardcoded URI scheme based on port number can lead to discrepancies in security checks, potentially issuing auto-trust for unreliable configurations. Specifically, an attacker with write access to a Vault file can manipulate the Hub configuration to use HTTPS with port 80, thereby passing auto-trust validation. This situation creates a window for network-based attackers to intercept OAuth token exchanges and gain unauthorized access to the Cryptomator Hub API. This issue has been rectified in version 1.19.2.

References