Vulnerability · Published Dec 15, 2025 · Assigned by LY-Corporation

CVE-2025-14022

High 7.7

In plain English

A high-severity improper certificate validation in LINE client for iOS from LINE Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.2%top 94.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of network traffic, which could allow a network-adjacent attacker to intercept or modify encrypted communications.

Affected products (as reported)

Vendor	Product	Versions
LINE Corporation	LINE client for iOS	15.3 – before 15.4

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

References

https://hackerone.com/reports/2853445