CVE-2016-2402

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.

• CWE-295

• http://www.openwall.com/lists/oss-security/2016/02/10/8Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/02/18/7Mailing List, Third Party Advisory
• https://koz.io/pinning-cve-2016-2402/Technical Description, Third Party Advisory
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
• https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/Vendor Advisory
• http://www.openwall.com/lists/oss-security/2016/02/10/8Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/02/18/7Mailing List, Third Party Advisory
• https://koz.io/pinning-cve-2016-2402/Technical Description, Third Party Advisory
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
• https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/Vendor Advisory

Published

Jan 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2392The is_rndis function in the USB Net device emulator (hw/usb…
• CVE-2016-2393Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerpr…
• CVE-2016-2396The GMS ViewPoint (GMSVP) web application in Dell SonicWALL …
• CVE-2016-2397The cliserver implementation in Dell SonicWALL GMS, Analyzer…
• CVE-2016-2398Comcast XFINITY Home Security System does not properly maint…
• CVE-2016-2399Integer overflow in the quicktime_read_pascal function in li…
• CVE-2016-2403Symfony before 2.8.6 and 3.x before 3.0.6 allows remote atta…
• CVE-2016-2404Huawei switches S5700, S6700, S7700, S9700 with software V20…
• CVE-2016-2405Huawei Policy Center with software before V100R003C10SPC020 …
• CVE-2016-2406The permission control module in Huawei Document Security Ma…
• CVE-2016-2407Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-2408Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer…