Executive brief
yapi is a popular API documentation and testing tool used by developers to manage and collaborate on API specifications. The application disables certificate validation in HTTPS connections, allowing attackers on the network to impersonate servers and intercept sensitive data including API credentials, test data, and configuration information. This creates a man-in-the-middle attack risk, particularly dangerous in environments where yapi is used to document and test production APIs.
Technical details
The vulnerability is an improper certificate validation flaw (CWE-295) where yapi explicitly sets 'rejectUnauthorized': false in the Axios HTTPS agent configuration, disabling TLS/SSL certificate validation. This allows network-level attackers to intercept and modify HTTPS traffic by presenting an untrusted certificate without triggering validation errors. The vulnerability affects yapi v1.12.0 and earlier versions; it is present in the postmanLib.js component where Axios is configured for making external API requests. An attacker positioned to perform man-in-the-middle attacks (e.g., on the same network, through DNS hijacking, or via compromised network infrastructure) can exploit this without authentication to intercept API documentation requests, steal authentication tokens, and modify API specifications. A fix requires enabling certificate validation in the Axios configuration.
Affected products
- YMFE yapi 1.12.0 and earlier
Timeline
- 2026-02-23: disclosed
- 2026-02-11: other: Vulnerability publicly documented