Insecure TLS certificate validation (accept self-signed certificate)

The application accepts self-signed certificates making it vulnerable to man-in-the-middle (MITM) attacks.

By default, SSL certificates are validated. If it's not the case with your application, consider:

Avoid tampering with SSL classes: Avoid overriding TrustManager or SSLSocketFactory to allow invalid certificates.
Certificate Pinning: Implement certificate pinning to ensure that the application only accepts certificates from trusted sources. By hardcoding or storing trusted certificates within the application, it can verify the authenticity of the server's certificate during the SSL/TLS handshake process, thereby preventing MITM attacks using self-signed certificates.