-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| serverpod_client | pub | < 1.2.6 | 1.2.6 |
Miggo AIRoot Cause AnalysisThe commit diff shows removal of a badCertificateCallback override in serverpod_client_io.dart that unconditionally returned true. This callback is responsible for certificate validation in Dart's HttpClient. By forcing it to always accept certificates, it disabled TLS validation entirely. The patch removed this insecure override, restoring proper certificate validation. The test file addition confirms the fix by verifying handshake failures with invalid certificates.