CVE-2026-33472
Logic Flaw in Cryptomator Allows OAuth Token Interception
Publication date: 2026-04-16
Last updated on: 2026-04-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cryptomator | cryptomator | to 1.19.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-305 | The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. |
| CWE-319 | The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Cryptomator version 1.19.1 due to a logic flaw in the CheckHostTrustController.getAuthority() method. The method incorrectly hardcodes the URI scheme based on the port number, causing HTTPS URLs using port 80 to be treated the same as HTTP URLs. This flaw allows an attacker with write access to a cloud-synced vault.cryptomator file to craft a configuration that bypasses security checks, leading to the vault being auto-trusted without user confirmation.
Specifically, an attacker can set apiBaseUrl and authEndpoint to use HTTPS on port 80 to pass validation, while the tokenEndpoint uses plaintext HTTP. This enables a network-positioned attacker to intercept the OAuth token exchange and gain unauthorized access to the Cryptomator Hub API as the victim.
This issue was fixed in version 1.19.2.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to bypass security checks and gain unauthorized access to your Cryptomator Hub API by intercepting OAuth token exchanges.
This means that an attacker with write access to your cloud-synced vault configuration file and positioned on the network can impersonate you and potentially access sensitive encrypted data or perform actions on your behalf within the Cryptomator environment.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Cryptomator to version 1.19.2 or later, where the issue has been fixed.