Disabled Certificate Validation

Vulnerable vs. safe

ServicePointManager.ServerCertificateValidationCallback = (s, cert, chain, errors) => true;

ServicePointManager.ServerCertificateValidationCallback = (s, cert, chain, errors) => errors == SslPolicyErrors.None;

Why it matters & how to fix it

TLS certificate validation is disabled by a callback that always returns true (or DangerousAcceptAnyServerCertificateValidator), so any certificate is accepted and the connection is exposed to man-in-the-middle interception (CWE-295). Remove the override and rely on default chain validation; for a private CA, add it to the trust store instead of bypassing validation.

References

• https://cwe.mitre.org/data/definitions/295.html
• https://learn.microsoft.com/en-us/dotnet/api/system.net.servicepointmanager.servercertificatevalidationcallback

Related checks

• JavaScript / TypeScript - Other Security Checks
  Child Process Shell True
• JavaScript / TypeScript - Other Security Checks
  Open Redirect Tainted Input
• Python - Other Security Checks
  Django Mark Safe
• Python - Other Security Checks
  Flask Debug Enabled
• Python - Other Security Checks
  Flask Render Template String
• Python - Other Security Checks
  Insecure Tempfile Mktemp