CVE-2025-65827

The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit. TThis may result in a total compromise of the user's account if the attacker intercepts a request with active authentication tokens or cracks the MD5 hash sent on login.

• CWE-319

• https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-clear-text-traffic-enabled-mdThird Party Advisory
• https://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Mobile-Application/Clear-Text-Traffic-Enabled.mdThird Party Advisory

Published

Dec 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-65821As UART download mode is still enabled on the ESP32 chip on …7.5
• CVE-2025-65822The ESP32 system on a chip (SoC) that powers the Meatmeet Pr…6.8
• CVE-2025-65823The Meatmeet Pro was found to be shipped with hardcoded Wi-F…9.8
• CVE-2025-65824An unauthenticated attacker within proximity of the Meatmeet…8.8
• CVE-2025-65825The firmware on the basestation of the Meatmeet is not encry…4.6
• CVE-2025-65826The mobile application was found to contain stored credentia…9.8
• CVE-2025-65828An unauthenticated attacker within proximity of the Meatmeet…6.5
• CVE-2025-65829The ESP32 system on a chip (SoC) that powers the Meatmeet ba…6.8
• CVE-2025-6583A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-65830Due to a lack of certificate validation, all traffic from th…9.1
• CVE-2025-65831The application uses an insecure hashing algorithm (MD5) to …7.5
• CVE-2025-65832The mobile application insecurely handles information stored…4.6