Vulnerabilities in Płatnik software

CERT Polska has received a report about vulnerabilities in Płatnik software maintained by Zakład Ubezpieczeń Społecznych and participated in coordination of their disclosure.

Update 03.11.2026: Metric number was updated.

The vulnerabilityCVE-2026-110970: Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own.

The vulnerabilityCVE-2026-110971: Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it.

The vulnerabilityCVE-2026-110972: Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process and authenticate as an arbitrary user.

These issues were fixed in metric 334 in version 10.02.002.

We thank Grzegorz Sawicki for the responsible report of the vulnerability CVE-2026-110970. We thank Wojciech Giełda for the responsible report of the vulnerabilities CVE-2026-110971 and CVE-2026-110972.