GOG Galaxy version 2.0.0.2 has a vulnerability due to missing SSL certificate validation. This flaw allows an attacker with control over the local network, DNS, or a proxy to perform man-in-the-middle attacks, potentially intercepting update requests and substituting legitimate installer or update files with malicious ones.