CVE-2026-114220: CWE-295 Improper Certificate Validation in NewType Infortech NT OneAPP

CVE-2026-114220 describes an improper certificate validation vulnerability in NewType Infortech's NT OneAPP. The application fails to properly validate the server certificate and hostname during TLS communications, enabling unauthenticated network-adjacent attackers to conduct man-in-the-middle attacks. This can lead to interception or modification of data exchanged between the client application and the server. The vulnerability affects all versions from 0 through 1.5.22 inclusive. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation allows attackers to intercept or alter communications between NT OneAPP and its server, potentially compromising confidentiality and integrity of data transmitted. Because the vulnerability requires no authentication and has low attack complexity, it poses a critical risk to users of affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using affected versions or employ network-level protections such as TLS interception detection or VPNs to reduce exposure.