Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm,… (CVE-2026-103502)

hex_core's default HTTP adapter uses the built-in httpc adapter which attempts to verify server certificates using public_key:cacerts_get/0. On Erlang/OTP 24, this function does not exist, causing all HTTPS requests to skip certificate verification. On OTP 25, if the operating system's CA certificates cannot be loaded, the function raises an error, triggering a fallback to default ssl options that do not verify certificates prior to OTP 26. hex_core versions before 0.11.0 never set ssl options explicitly, resulting in no certificate verification on OTP 25 and earlier regardless of CA store presence. Although warnings exist in the README and adapter logs about insecure defaults, they do not explicitly state the absence of certificate verification or clarify affected OTP versions. This vulnerability allows attackers capable of intercepting HTTPS traffic to impersonate trusted servers to clients using vulnerable hex_core versions on affected OTP versions.

An attacker who can intercept HTTPS connections can impersonate hex.pm, repo.hex.pm, or other API servers to clients using vulnerable hex_core versions on Erlang/OTP 24 or OTP 25 without CA certificates. This undermines the authenticity of HTTPS communications, potentially enabling man-in-the-middle attacks, data interception, or injection of malicious content during package retrieval or API interactions. The vulnerability affects the trust model of TLS connections in these environments.

Users should upgrade hex_core to version 0.20.0 or later, which addresses the issue by enforcing certificate verification with secure SSL defaults on OTP 25 and above. For environments running OTP 24 or OTP 25 without CA certificates, upgrading the Erlang/OTP runtime to version 26 or later, which verifies certificates by default, is recommended. Users should also consider using alternative HTTP clients as suggested in the hex_core README to avoid relying on the insecure default httpc adapter. The vendor advisory does not indicate that this issue is already mitigated or that no action is required.