A critical TLS certificate validation flaw in the cpp-httplib library allows unauthenticated remote attackers to perform man-in-the-middle attacks and intercept sensitive data.

This is an improper certificate validation flaw (CWE-295) where the library disables hostname and certificate checks when following an HTTPS redirect. Any unauthenticated attacker capable of triggering a redirect can intercept secure communications, including credentials and session tokens.

The vulnerability poses a severe risk to the confidentiality and integrity of application data. By successfully bypassing TLS protections, attackers can gain unauthorized access to sensitive session information, potentially leading to full account takeover or data exfiltration. Given the CVSS score of 8.7, this vulnerability is considered a high-severity risk that requires immediate remediation to prevent widespread compromise of authenticated sessions.

Immediate Action: Update the cpp-httplib library to version 0.37.2 or later to ensure proper certificate validation is enforced during redirect operations.

Proactive Monitoring: Review application logs for unusual redirect patterns or traffic anomalies that may suggest an attempt to intercept outbound HTTPS connections.

Compensating Controls: If immediate patching is not possible, ensure that applications using this library are configured to verify certificate chains manually or limit the use of redirects when handling sensitive user information.

Public Exploit Available: Unknown

Given the high impact of this vulnerability, organizations relying on the cpp-httplib library should prioritize the upgrade to version 0.37.2 immediately. Failure to address this issue leaves applications vulnerable to sophisticated man-in-the-middle attacks that can bypass standard encryption protections. Verify that all dependencies are updated and validate that the fix is correctly integrated into the production environment.