A critical security vulnerability was discovered in GoSign Desktop, a widely used electronic signature solution by Tinexta InfoCert. The flaws include disabled TLS certificate validation and an unverified update mechanism, enabling attackers to intercept sensitive data (e.g., credentials, documents, authentication tokens) via man-in-the-middle (MitM) attacks or deliver malicious updates. Since GoSign Desktop is often deployed in government agencies, enterprises, and legal workflows—sometimes with administrator-level privileges—exploitation could lead to document tampering, fraud, or legal liability. The lack of public patches or remediation timelines from InfoCert exacerbates the risk, leaving organizations exposed unless they implement compensating controls (e.g., network isolation, migration to the SaaS version). The vulnerability undermines trust in digital signature workflows, particularly in sectors where legally binding documents are processed.