Insufficient TLS Certificate Verification for Banking List Downloads

CMS fields

• Advisory: Insufficient TLS Certificate Verification for Banking List Downloads
• Advisory ID: BGSA-2026-006 (proposed; confirm availability)
• Reporter reference: BG-05 (TLS)
• CVE: Not assigned
• Severity: High (researcher-assessed; no CVSS score assigned)
• Affected version: 2.0.3 — commit bb3a210 (reproduced by the maintainer)
• Fixed version: 2.0.4 (maintainer-confirmed corrected release)
• Status: Draft — publication pending coordinated disclosure
• Meta title: BastionGuard Banking List TLS Verification | BGSA-2026-006
• Meta description: Security advisory for reported disabled TLS certificate verification during banking list retrieval in BastionGuard 2.0.3.
• Index: No while draft; Yes after coordinated publication
• Redirect: None
• Suggested slug: bank-list-tls-verification

Advisory body (English)

Summary

A banking-list download path was reported to disable peer and hostname verification for HTTPS connections.

Security impact

On an affected installation, an active network attacker could interfere with downloaded banking-list content because server identity might not be authenticated.

Affected and fixed versions

The project maintainer reproduced the reported vulnerability in BastionGuard 2.0.3, commit bb3a210. The correction is included in BastionGuard 2.0.4, as confirmed by the maintainer and supported by the reviewed source and regression tests. Versions other than the confirmed affected revision have not been exhaustively assessed.

Remediation

• Enforce TLS peer certificate verification and hostname verification for banking-list downloads.
• Reject invalid browser certificate chains rather than bypassing certificate errors.
• Consider cryptographic signatures for remote trust-list content as an additional defense beyond TLS.

Recommended action: Upgrade to the verified official BastionGuard 2.0.4 build or a later maintained release.

Verification scope

The corrected source enables libcurl certificate and hostname verification and cancels browser certificate errors. The maintainer reproduced the historical vulnerability; independent man-in-the-middle integration testing of the corrected build and signed-list authenticity assessment were not performed.

Credits

Reported by Shaik Ikram. The project thanks the researcher for the responsible security report and requests that publication be coordinated with the researcher’s agreed disclosure schedule.

References

• BastionGuard source repository
• Security policy

Timeline

• Report received: October 2026
• Disclosure date: To be agreed / added before publication
• Fix release date: Confirm from the published 2.0.4 release record

Editorial verification (not part of public advisory): Maintainer confirms reproduction on bb3a210 and remediation in 2.0.4. Before publication, record the released package/tag and date, reserve the advisory ID, agree disclosure timing and credit with the researcher, and evaluate CVE eligibility through the appropriate CNA. Do not invent a CVE or CVSS score.