Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rqct-cbjm-1beq
Vulnerability ID VCID-rqct-cbjm-1beq
Aliases CVE-2016-2402
GHSA-4hc2-jh7r-wrc3
Summary OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-295 Improper Certificate Validation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
epss 0.02681 https://api.first.org/data/v1/epss?cve=CVE-2016-2402
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-4hc2-jh7r-wrc3
cvssv3.1 5.9 https://github.com/square/okhttp
generic_textual MODERATE https://github.com/square/okhttp
cvssv3.1 5.9 https://koz.io/pinning-cve-2016-2402
generic_textual MODERATE https://koz.io/pinning-cve-2016-2402
cvssv3.1 5.9 https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
generic_textual MODERATE https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2016-2402
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2016-2402
cvssv3.1 5.9 https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability
generic_textual MODERATE https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability
cvssv3.1 5.9 http://www.openwall.com/lists/oss-security/2016/02/10/8
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2016/02/10/8
cvssv3.1 5.9 http://www.openwall.com/lists/oss-security/2016/02/18/7
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2016/02/18/7
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2016-2402
https://github.com/square/okhttp
https://github.com/square/okhttp/commit/3ccb46dd16b6ec98f70b0ee53eafe5ed6380891e
https://github.com/square/okhttp/commit/5377f25d9eed755328216912ef5e922c93e14f3
https://github.com/square/okhttp/commit/784fabac7d1586a5614bd4bc8854fd62850dbe26
https://koz.io/pinning-cve-2016-2402
https://koz.io/pinning-cve-2016-2402/
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability
https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/
http://www.openwall.com/lists/oss-security/2016/02/10/8
http://www.openwall.com/lists/oss-security/2016/02/18/7
CVE-2016-2402 https://nvd.nist.gov/vuln/detail/CVE-2016-2402
GHSA-4hc2-jh7r-wrc3 https://github.com/advisories/GHSA-4hc2-jh7r-wrc3
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/square/okhttp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://koz.io/pinning-cve-2016-2402
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-2402
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at http://www.openwall.com/lists/oss-security/2016/02/10/8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at http://www.openwall.com/lists/oss-security/2016/02/18/7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.8577
EPSS Score 0.02681
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:38:16.352018+00:00 ProjectKB MSRImporter Import https://raw.githubusercontent.com/SAP/project-kb/master/MSR2019/dataset/vulas_db_msr2019_release.csv 38.0.0