CVE-2025-65827

The Meatmeet mobile application is configured to allow clear text traffic to all domains, communicating with the API server via HTTP instead of HTTPS. An attacker positioned in the middle of the network (man-in-the-middle attack, 'upstream') can intercept transmitted traffic, read its contents, and modify requests during transmission. During login, the application sends the password hash in MD5 format, which is vulnerable to cracking. If an attacker intercepts a request containing active authentication tokens, they can immediately take over the user's session without needing to crack the password.

An attacker can intercept active authentication tokens or the MD5 hash of the password, which may lead to complete account takeover. It is also possible to modify requests during transmission.

Apply patches available from the manufacturer according to the references. The manufacturer should enforce the use of encrypted HTTPS protocol for all communication with the API server, remove the allowance for clear text traffic in the application configuration, and replace the weak MD5 hashing algorithm with a secure mechanism for storing and transmitting credentials (e.g., bcrypt, Argon2). Until the patch is implemented, users should avoid using the application on untrusted networks (public Wi-Fi).

Meatmeet mobile application (Meatmeet product); specific versions indicated in the manufacturer's references