# Insecure TLS verification defaults

TLS clients or proxies where undefined, hardcoded, or default options silently skip certificate validation

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; 2 confirmed bounties: $150 and $1,000; latest 2026-07-21. Updated 2026-11-02._

## How it works
TLS verification should be on unless the caller explicitly opts out. This pattern breaks that assumption three ways: an option value that is neither `true` nor `false` (an explicit `undefined`) is coerced into the insecure branch instead of falling back to the documented default of `true` [E1](https://bugbountylibrary.com/r/h1%3A1278254.md); a client hardcodes `InsecureSkipVerify: true` with no config gate [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md); or a proxy dispatcher never performs and validates the origin TLS handshake, so the proxy sees the traffic [E3](https://bugbountylibrary.com/r/h1%3A1599063.md). In each case the code looks like it validates, but the certificate is never checked.

## Where it shows up
- Options objects built dynamically, where keys can be present with value `undefined` rather than absent [E1](https://bugbountylibrary.com/r/h1%3A1278254.md).
- A single outbound TLS client with a hardcoded skip-verify flag among siblings that expose a secure-by-default toggle [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md).
- `ServerName`/SNI set but verification disabled — SNI is not validation [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md).
- Proxy dispatchers and HTTP-proxy agents for `fetch`/`https` that forward rather than tunnel [E3](https://bugbountylibrary.com/r/h1%3A1599063.md).
- Any path where the origin handshake is terminated at the proxy instead of end-to-end [E3](https://bugbountylibrary.com/r/h1%3A1599063.md).

## How to review
Invariant: every outbound TLS connection validates the origin certificate against the trust store unless the operator explicitly and visibly opts out. Check:
- Does option handling treat only the literal `false` as insecure, and any other value (including `undefined`/`null`) as the secure default? [E1](https://bugbountylibrary.com/r/h1%3A1278254.md)
- Is there a config gate for skip-verify, and is it off by default? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md)
- Does the proxy path perform and validate the origin handshake end-to-end? [E3](https://bugbountylibrary.com/r/h1%3A1599063.md)
- Diff one TLS client against all its siblings; the odd one out is the suspect [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md).

## How finders spotted it
- Read the docs claiming only literal `false` disables verification, then tested an explicit `undefined` against `expired.badssl.com` and saw the request succeed; traced it to a package that builds options with explicit `undefined` fields [E1](https://bugbountylibrary.com/r/h1%3A1278254.md).
- Code review of the internal client spotted hardcoded `InsecureSkipVerify=true`, compared it against every other outbound TLS client (all configurable), traced the dialer for loopback pinning, and confirmed the token was a static bearer header and sole gate for internal routes [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md).
- E3: how it was found is not stated in the evidence.

## Variants seen
- Coercion bug: explicit `undefined` treated as `false` [E1](https://bugbountylibrary.com/r/h1%3A1278254.md).
- Hardcoded skip-verify with no override [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md).
- Proxy that never validates the origin certificate [E3](https://bugbountylibrary.com/r/h1%3A1599063.md).

## Impact and severity
E1 silently disabled validation for every connection made by all users of a widely used npm package [E1](https://bugbountylibrary.com/r/h1%3A1278254.md). E2 let an on-path attacker MITM split-host deployments and steal a static `INTERNAL_TOKEN`; because internal routes are mounted on the public listener, the stolen token was replayable by anyone reaching the Gitea port [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md). E3 exposed all HTTPS traffic through the proxy to the proxy or any network-path attacker [E3](https://bugbountylibrary.com/r/h1%3A1599063.md). Severity rises with reach (default-on for a whole dependency) and with what the credential unlocks (full internal API) [E1](https://bugbountylibrary.com/r/h1%3A1278254.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **code.gitea.io/gitea (go)** < 1.27.0, fixed in 1.27.0: Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CVE-2026-54481). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md
- **Node.js**: Undici ProxyAgent vulnerable to MITM . Report: https://bugbountylibrary.com/r/h1%3A1599063.md
- **Node.js**: Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all ce (CVE-2021-22939). Report: https://bugbountylibrary.com/r/h1%3A1278254.md

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1278254.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-94v3-77j7-vm48.md
- E3: https://bugbountylibrary.com/r/h1%3A1599063.md