"Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.

"Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.

"Kura Sushi Official App" provided by EPG, Inc. contains the following vulnerability.<a href='https://cwe.mitre.org/data/definitions/295.html' target='_blank'></a><ul><li>Improper certificate validation on push notifications (CWE-295) - CVE-2026-41872</li><ul><li>This analysis assumes a man-in-the-middle attack being conducted with a malicious wireless LAN access point</li></ul></ul>Tsuyoshi Ogawa of SAK University SIE Co., Ltd. reported this vulnerability to IPA.JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.