# TLS downgrade and validation skip

TLS upgrade or retry paths that proceed on failure or accept unvalidated certificates

_Area: Web authentication and account takeover. Seen in 3 disclosed reports; one confirmed bounty: $300; latest 2026-05-27. Updated 2026-11-01._

## How it works
A connection is supposed to become encrypted, but the code treats encryption as best-effort. The upgrade step (STARTTLS, a TLS upgrade hook, a webview load) can fail, be skipped, or be bound to the wrong socket, and the caller continues on the plaintext or unvalidated path anyway. The broken assumption is that "we asked for TLS" means "we got TLS." Nothing enforces that the encrypted state was actually reached before credentials or data flow.

## Where it shows up
- TLS-upgrade helpers where only the success branch calls the TLS routine, with no `else`/raise on NO/BAD or unexpected responses [E3](https://bugbountylibrary.com/r/h1%3A1178562.md).
- Retry/reconnect paths (autoSelectFamily, happy-eyeballs) that carry hooks or callbacks bound to a discarded handle [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-chqv-56wv-7564.md).
- Embedded webviews in desktop apps that load login/registration pages without cert validation [E2](https://bugbountylibrary.com/r/h1%3A903424.md).
- Defaults like `usessl=false` that make the plaintext path reachable.
- Any code where a failed handshake returns normally instead of throwing.

## How to review
The invariant: after the upgrade step, the connection must be provably encrypted and authenticated, or the operation must abort. Check every branch of the upgrade helper — is there a failure path that raises? Trace retry/reinit code and confirm hooks are rebound to the new handle, not the old one. For webviews, confirm cert validation is on and test by proxying through an intercepting proxy: a self-signed cert must produce an error, not a page [E2](https://bugbountylibrary.com/r/h1%3A903424.md). For STARTTLS, confirm a stripped or refused upgrade aborts before any credential is sent [E3](https://bugbountylibrary.com/r/h1%3A1178562.md).

## Variants seen
- Silent ignore of non-OK STARTTLS response, caller proceeds plaintext [E3](https://bugbountylibrary.com/r/h1%3A1178562.md).
- Stale upgrade hook on retry leaves fallback socket unencrypted [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-chqv-56wv-7564.md).
- Webview skips cert validation entirely, accepting attacker certs [E2](https://bugbountylibrary.com/r/h1%3A903424.md).

## Impact and severity
Leads to plaintext exposure of credentials, tokens and card data, or MITM-served content in a trusted window. Severity is high because the failure is silent: users and callers see a normal connection. Worse when defaults favor plaintext [E3](https://bugbountylibrary.com/r/h1%3A1178562.md) or the path handles secrets directly [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-chqv-56wv-7564.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-chqv-56wv-7564.md
- E2: https://bugbountylibrary.com/r/h1%3A903424.md
- E3: https://bugbountylibrary.com/r/h1%3A1178562.md