Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In GalaxyFDSClientImpl.createHttpClient(), the SDK configures Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER, which accepts any valid TLS certificate regardless of hostname mismatch. Because HTTPS is enabled by default in FDSClientConfiguration, all applications using the SDK with default settings are affected. This vulnerability allows a man-in-the-middle attacker to intercept and modify SDK communications to Xiaomi FDS cloud storage endpoints, potentially exposing authentication credentials, file contents, and API responses. The XiaoMi/galaxy-fds-sdk-android open source project has reached end-of-life status.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-26214 TLS Hostname Verification Bypass in Galaxy FDS Android SDK 3.0.8 and Prior https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26214
Post summary
The text lists CVE-2026-26214 as a TLS hostname verification bypass in Galaxy FDS Android SDK, but provides no evidence of a PoC, exploit, patch, or active exploitation.
CVE-2026-26214 Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration). In… https://www.cve.org/CVERecord?id=CVE-2026-26214
Post summary
The CVE-2026-26214 vulnerability in XiaoMi’s Galaxy FDS Android SDK (v3.0.8 and prior) disables TLS hostname verification by default when HTTPS is enabled, potentially allowing man‑in‑the‑middle attacks.