CVE-2023-38688

twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.

• CWE-311

• https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23Product
• https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350aPatch
• https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jxVendor Advisory
• https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23Product
• https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350aPatch
• https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jxVendor Advisory

Published

Aug 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-38682A vulnerability has been identified in JT2Go (All versions <…7.8
• CVE-2023-38683A vulnerability has been identified in JT2Go (All versions <…7.8
• CVE-2023-38684Discourse is an open source discussion platform. Prior to ve…7.5
• CVE-2023-38685Discourse is an open source discussion platform. Prior to ve…4.3
• CVE-2023-38686Sydent is an identity server for the Matrix communications p…5.3
• CVE-2023-38687Svelecte is a flexible autocomplete/select component written…5.4
• CVE-2023-38689Logistics Pipes is a modification (a.k.a. mod) for the compu…9.8
• CVE-2023-3869The wpDiscuz plugin for WordPress is vulnerable to unauthori…5.3
• CVE-2023-38690matrix-appservice-irc is a Node.js IRC bridge for Matrix. Pr…9.8
• CVE-2023-38691matrix-appservice-bridge provides an API for setting up brid…6.5
• CVE-2023-38692CloudExplorer Lite is an open source, lightweight cloud mana…9.8
• CVE-2023-38693Lucee Server (or simply Lucee) is a dynamic, Java based, tag…9.8