🚨 𝗔𝗻𝗱𝗿𝗼𝗶𝗱 𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗲𝗿𝘀: 𝗖𝗵𝗲𝗰𝗸 𝗬𝗼𝘂𝗿 𝗢𝗸𝗛𝘁𝘁𝗽 𝗩𝗲𝗿𝘀𝗶𝗼𝗻

A security issue, CVE-2026–111943, affects certificate validation in certain OkHttp versions.

Let’s understand it with a simple real-world example 👇

🏢 𝗜𝗺𝗮𝗴𝗶𝗻𝗲 𝗮 𝗦𝗲𝗰𝘂𝗿𝗲 𝗖𝗹𝘂𝗯

Your club trusts IDs issued by a particular authority.

But suddenly, you discover that the authority’s signing keys have been compromised.

An attacker can now create a fake ID that looks completely legitimate.

Your existing security check says:

✅ “The ID is from a trusted authority.”

But it doesn’t know that this particular certificate is compromised.

That’s the problem.

🔴 𝗪𝗵𝗮𝘁 𝗖𝗼𝘂𝗹𝗱 𝗛𝗮𝗽𝗽𝗲𝗻?

An attacker could potentially use a compromised certificate to impersonate a server and perform a man-in-the-middle attack.

For an Android app communicating with APIs, that could put sensitive traffic at risk.

🛡️ 𝗧𝗵𝗲 𝗪𝗼𝗿𝗸𝗮𝗿𝗼𝘂𝗻𝗱

Get Udaya Murthy’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Before an official OkHttp update was available, developers could use a custom HostnameVerifier to reject certificates known to be compromised.

Conceptually:

val safeClient = client.newBuilder()
    .hostnameVerifier(
        ForbiddenCertificatesHostnameVerifier()
    )
    .build()

Think of it as adding a temporary “Do NOT accept these specific IDs” blacklist to your security guard.

✅ 𝗧𝗵𝗲 𝗕𝗲𝘀𝘁 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻

Instead of maintaining custom security code, upgrade OkHttp to a version containing the official fix.

📌 OkHttp 4.12.1
📌 OkHttp 5.5.1

After upgrading, OkHttp can reject the affected certificates without requiring your application to maintain its own workaround.

💡 𝗞𝗲𝘆 𝗧𝗮𝗸𝗲𝗮𝘄𝗮𝘆

Security vulnerabilities aren’t always solved by writing more application code.

Sometimes the safest fix is simply:

👉 Check your dependency version.
👉 Upgrade to the patched release.
👉 Remove temporary workarounds when they’re no longer needed.

As Android developers, keeping dependencies updated isn’t just about getting new features.

🔐 It’s part of application security.

Would you check your Android projects for vulnerable OkHttp versions today?

#AndroidDev #AndroidSecurity #OkHttp #Kotlin #CyberSecurity #AndroidDevelopment #AppSecurity