Threats affecting pkg:github/cryptomator/android

CVE-2026-32317 is a high-severity vulnerability in Cryptomator for Android versions prior to 1.12.3. It stems from an origin validation error where the client trusted endpoints specified in the vault configuration file without verifying host authenticity. This flaw allows an attacker who can tamper with the vault.cryptomator file to mix legitimate authentication endpoints with malicious API endpoints, leading to token exfiltration via a man-in-the-middle attack during the Hub key loading process. Exploitation requires the attacker to have the capability to alter the vault configuration file and the user to unlock a Hub-backed vault with a vulnerable client version. The vulnerability impacts confidentiality by exposing authentication tokens but does not affect availability. The issue has been patched in version 1.12.