Płatnik software patches three auth flaws
CERT Polska coordinated disclosure of three vulnerabilities in ZUS's Płatnik software allowing MITM attacks, weak password decoding, and authentication bypass; fixed in version 10.02.002 metric 242.
Sourcecert.pl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed three vulnerabilities in Płatnik, software maintained by Zakład Ubezpieczeń Społecznych (ZUS), Poland's Social Insurance Institution. The flaws affect all versions before metric 242 in version 10.02.002.
CVE-2026-110970 stems from Płatnik's use of unencrypted HTTP to download updates, libraries, and support files, enabling a man-in-the-middle attacker to intercept transmitted data or replace legitimate files with malicious ones. CVE-2026-110971 involves a weak password encoding algorithm, allowing anyone who obtains the encoded password to easily decode it. CVE-2026-110972 is the most severe: Płatnik performs client-side authentication, meaning an attacker with access to any application instance connected to the backend server can bypass login verification entirely and authenticate as an arbitrary user.
All three issues were fixed in Płatnik version 10.02.002, metric 242. There is no indication of in-the-wild exploitation; this is a coordinated vulnerability disclosure report. Defenders using Płatnik should update to the patched version immediately, given the combination of insecure update delivery and authentication bypass could allow full account impersonation and potential supply-chain-style tampering via the HTTP update mechanism.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-110970
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs