CVE-2026-26214

In the GalaxyFDSClientImpl.createHttpClient() method, the SDK configures Apache HttpClient with the SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER parameter, which causes acceptance of any valid TLS certificate without checking whether it matches the target hostname. Because HTTPS is enabled by default in the FDSClientConfiguration class, every application using the default settings is affected by this issue. An attacker capable of assuming a man-in-the-middle position on the network can substitute their own certificate and fully control communication between the application and Xiaomi FDS services.

An attacker can intercept and modify SDK communication with Xiaomi FDS endpoints, gaining access to authentication credentials, transmitted file contents, and API responses. Theft of sensitive user data and manipulation of transmitted content is possible.

The XiaoMi/galaxy-fds-sdk-android project has reached end-of-life status and no patches are being released for it. Usage of this library should be discontinued and replaced with an actively maintained alternative. As a temporary workaround — in existing code, replace SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER with proper hostname verification or implement a custom SSLSocketFactory with correct certificate validation.

Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) versions 3.0.8 and earlier; all applications using the SDK with default HTTPS configuration