{"id":"CVE-2023-38688","aliases":["EUVD-2023-1987","GHSA-779w-xvpm-78jx"],"status":"published","title":"twitch-tui's connection is not encrypted","description":"twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00527,"percentile":0.44962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-311"],"published":"2023-07-31T22:02:54Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"crates.io","package":"twitch-tui","fixed_in":["2.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"twitch-tui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"twitch-tui","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.1"}]}]}],"products":[{"vendor":"xithrius","product":"twitch-tui"}],"references":[{"url":"https://github.com/Xithrius/twitch-tui/security/advisories/GHSA-779w-xvpm-78jx","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/Xithrius/twitch-tui/commit/74d13ddca35f8f0816f4933c229da1fd95c0350a","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38688","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-779w-xvpm-78jx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38688.json","tags":["advisory"]},{"url":"https://github.com/Xithrius/twitch-tui","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-38688","title":"twitch-tui's connection is not encrypted","description":"twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.","status":"published","published":"2023-08-04T16:18:15.288Z","modified":"2024-10-09T16:26:21.732Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-311"],"updated_at":"2026-11-02T14:35:29.772612Z"}],"euvd":[{"id":"EUVD-2023-1987","description":"twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.","status":"published","published":"2023-08-04T16:18:15Z","modified":"2024-10-09T16:26:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:27:42.985312Z"}],"ghsa":[{"id":"GHSA-779w-xvpm-78jx","title":"twitch-tui's connection is not encrypted","description":"### Summary\nThe connection is not using TLS for communication\n\n### Details\nIn the configuration of the irc connection, [you are disabling tls](https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23) which makes all communication to twitch irc servers unencrypted.\n\n### PoC\nYou can verify by using tcpdump/wireshark that traffic is unencrypted.\n\n### Impact\nCommunication can be sniffed, even auth tokens.","status":"published","published":"2023-07-31T22:02:54Z","modified":"2023-11-06T05:01:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-311"],"updated_at":"2026-11-02T14:37:14.234712Z"}],"nvd":[{"id":"CVE-2023-38688","description":"twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.","status":"published","published":"2023-08-04T17:15:10.097Z","modified":"2026-06-17T06:10:57.417Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-311"],"updated_at":"2026-11-02T14:08:20.798312Z"}],"osv":[{"id":"CVE-2023-38688","title":"twitch-tui's connection is not encrypted","description":"twitch-tui provides Twitch chat in a terminal. Prior to version 2.4.1, the connection is not using TLS for communication. In the configuration of the irc connection, the software disables TLS, which makes all communication to Twitch IRC servers unencrypted. As a result, communication, including auth tokens, can be sniffed. Version 2.4.1 has a patch for this issue.","status":"published","published":"2023-08-04T16:18:15.288Z","modified":"2026-10-28T02:30:51.717791239Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-311"],"updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"GHSA-779w-xvpm-78jx","title":"twitch-tui's connection is not encrypted","description":"### Summary\nThe connection is not using TLS for communication\n\n### Details\nIn the configuration of the irc connection, [you are disabling tls](https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23) which makes all communication to twitch irc servers unencrypted.\n\n### PoC\nYou can verify by using tcpdump/wireshark that traffic is unencrypted.\n\n### Impact\nCommunication can be sniffed, even auth tokens.","status":"published","published":"2023-07-31T22:02:54Z","modified":"2026-09-10T03:49:54.356732717Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-311"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}