CVE-2026-26214 is a critical vulnerability in Xiaomi Technology Co., Ltd.'s Galaxy FDS Android SDK (version 3.0.8 and prior) where TLS hostname verification is disabled by default. The SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER in the createHttpClient() method, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by default, all applications using the SDK with default settings are vulnerable. This flaw allows a man-in-the-middle attacker to intercept and alter SDK communications to Xiaomi FDS cloud storage endpoints, risking exposure of authentication credentials, file contents, and API responses. The SDK is no longer maintained, and no patch or official fix is available.

An attacker positioned to perform a man-in-the-middle attack can intercept and modify HTTPS communications between applications using the vulnerable Galaxy FDS Android SDK and Xiaomi FDS cloud storage endpoints. This can lead to exposure of sensitive data including authentication credentials, file contents, and API responses, compromising confidentiality and integrity of the data exchanged.

The Galaxy FDS Android SDK is end-of-life and no official patch or fix is available. Users should discontinue use of this SDK and migrate to alternative, actively maintained solutions that properly validate TLS certificates including hostname verification. Until migration, avoid using the SDK with default HTTPS settings or implement additional application-level TLS validation if feasible.