Threats affecting pkg:github/cryptomator/ios

CVE-2026-32318 is a high-severity vulnerability affecting Cryptomator for iOS versions prior to 2.8.3. It involves an origin validation error where the client improperly trusts endpoints specified in the vault configuration file without verifying host authenticity. This flaw allows an attacker who can modify the vault.cryptomator file to tamper with the vault configuration, enabling a man-in-the-middle attack during the Hub key loading process. The attacker could exfiltrate authentication tokens by mixing legitimate and malicious API endpoints. The vulnerability requires the attacker to have the capability to alter the vault file and the user to unlock a Hub-backed vault using an affected client version. The issue has been patched in version 2.8.