NewType Infortech's NT OneAPP, through version 1.5.22, does not validate server certificates or hostnames. An unauthenticated attacker can therefore intercept or modify the app's traffic to its server.
What Is It
CVE-2026-114220 is an Improper Certificate Validation flaw (CWE-295) in NT OneAPP, which NewType Infortech develops. When the app connects to its server, it checks neither the server certificate nor the hostname. An attacker can get between the app and the server and run a man-in-the-middle (MITM) attack to intercept or change the traffic.
TWCERT/CC ([email protected]) reported the issue. NVD published it on 2026-10-22, and its NVD status is currently "Received."
Why It Matters
TWCERT rates the flaw CRITICAL:
- CVSS v3.1: 9.1 (
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) - CVSS v4.0: 9.3. The available record lists these vulnerable-system metrics: Attack Vector Network (AV:N), Attack Complexity Low (AC:L), Attack Requirements None (AT:N), Privileges Required None (PR:N), User Interaction None (UI:N), and High confidentiality and integrity impact with no availability impact (VC:H/VI:H/VA:N). The subsequent-system impact metrics (SC, SI, SA) are not given here, so this is not a complete CVSS v4.0 vector string.
The attacker needs no privileges and no user interaction, and attack complexity is low. Confidentiality and integrity impacts are both High. An attacker who intercepts the traffic can read and change data moving between the app and its backend. Availability is not affected.
The sources disagree slightly on where the attacker has to be. The written description says "network-adjacent" attackers, but both CVSS scorings rate the attack vector as Network.
Exploitation status: CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. The CVSS v4.0 Exploit Maturity metric is "Not Defined."
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| NewType Infortech | NT OneAPP | 0 through 1.5.22 (inclusive) |
By default, versions outside this range are listed as unaffected. NVD has no CPE entries for this record yet.
Patch Status
The NVD record does not name a fixed version or give remediation guidance. With no KEV entry, CISA has not set a required action or due date. The affected range ends at 1.5.22, but no source here confirms that a later build has been released or that it fixes the flaw. Organizations running NT OneAPP 1.5.22 or earlier should read the TWCERT advisories below for any vendor guidance. They should also contact NewType Infortech directly to confirm whether a fixed version exists. Until a fixed build is confirmed and installed, treat traffic between the app and its server as open to interception on untrusted networks.