Press enter or click to view image in full size

🚨 𝗔𝗻𝗱𝗿𝗼𝗶𝗱 𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗲𝗿𝘀: 𝗖𝗵𝗲𝗰𝗸 𝗬𝗼𝘂𝗿 𝗢𝗸𝗛𝘁𝘁𝗽 𝗩𝗲𝗿𝘀𝗶𝗼𝗻

A security issue, CVE-2026–111943, affects certificate validation in certain OkHttp versions.

Let’s understand it with a simple real-world example 👇

🏢 𝗜𝗺𝗮𝗴𝗶𝗻𝗲 𝗮 𝗦𝗲𝗰𝘂𝗿𝗲 𝗖𝗹𝘂𝗯

Your club trusts IDs issued by a particular authority.

But suddenly, you discover that the authority’s signing keys have been compromised.

An attacker can now create a fake ID that looks completely legitimate.

Your existing security check says:

✅ “The ID is from a trusted authority.”

But it doesn’t know that this particular certificate is compromised.

That’s the problem.

🔴 𝗪𝗵𝗮𝘁 𝗖𝗼𝘂𝗹𝗱 𝗛𝗮𝗽𝗽𝗲𝗻?

An attacker could potentially use a compromised certificate to impersonate a server and perform a man-in-the-middle attack.

For an Android app communicating with APIs, that could put sensitive traffic at risk.

🛡️ 𝗧𝗵𝗲 𝗪𝗼𝗿𝗸𝗮𝗿𝗼𝘂𝗻𝗱

Before an official OkHttp update was available, developers could use a custom HostnameVerifier to reject certificates known to be compromised.

Conceptually:

val safeClient = client.newBuilder()
    .hostnameVerifier(
        ForbiddenCertificatesHostnameVerifier()
    )
    .build()

Think of it as adding a temporary “Do NOT accept these specific IDs” blacklist to your security guard.

✅ 𝗧𝗵𝗲 𝗕𝗲𝘀𝘁 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻

Instead of maintaining custom security code, upgrade OkHttp to a version containing the official fix.

📌 OkHttp 4.12.1
📌 OkHttp 5.5.1

After upgrading, OkHttp can reject the affected certificates without requiring your application to maintain its own workaround.

💡 𝗞𝗲𝘆 𝗧𝗮𝗸𝗲𝗮𝘄𝗮𝘆

Security vulnerabilities aren’t always solved by writing more application code.

Sometimes the safest fix is simply:

👉 Check your dependency version.
👉 Upgrade to the patched release.
👉 Remove temporary workarounds when they’re no longer needed.

As Android developers, keeping dependencies updated isn’t just about getting new features.

🔐 It’s part of application security.

Would you check your Android projects for vulnerable OkHttp versions today?

#AndroidDev #AndroidSecurity #OkHttp #Kotlin #CyberSecurity #AndroidDevelopment #AppSecurity