CVE-2026-102671CWE-295

CVE-2026-102671

Medium · published October 2, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
2.3
In the wild
Unconfirmed
What it is

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00129 · 2.3th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-10-02T00:17Z
References (2)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-03.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-102671 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 19:43Z
    Joyland AI WebView accepts invalid SSL certificates
    cvelistv5