CVE-2026-114611: CWE-295: Improper Certificate Validation in schorschii OCO-Server

OCO-Server's Apple MDM enrollment endpoint `frontend/api-mdm.php` prior to version 1.2.3 uses `openssl_pkcs7_verify` with the `PKCS7_NOVERIFY` flag, disabling signer certificate chain and trust validation. Consequently, any self-signed certificate embedded in the PKCS#7 blob is accepted, allowing attackers to forge enrollment requests by using a victim device's serial number and an attacker-chosen UDID. The server then issues a legitimate MDM identity certificate and private key for the victim device, bundled in a `.mobileconfig` profile. This enables the attacker to impersonate the victim device in subsequent MDM traffic, gaining control over management data, push tokens, and enrollment processes. The vulnerability is fixed in version 1.2.3.

An attacker can obtain a valid MDM identity certificate and private key for a victim device by forging enrollment requests, enabling full impersonation of the device in MDM communications. This compromises confidentiality and integrity of device management data and allows disruption or redirection of device enrollment. The vulnerability has a CVSS 3.1 score of 9.1 (critical) with network attack vector, no privileges required, and no user interaction needed.

Upgrade OCO-Server to version 1.2.3 or later, where proper certificate validation is enforced. No other mitigations are indicated by the vendor advisory.