CWE-295: TLS verification disabled in Let's Encrypt ACME flow — CURLOPT_SSL_VERIFYPEER+VERIFYHOST both false

[LeoWSY-hashblue]

Summary

class/panelLets.py hardcodes TLS verification disabled during ACME certificate issuance. Panel API credentials transmitted over unverified TLS. BaoTa is China #1 server management panel with 4.5k stars.

Impact

ACME certificate issuance process vulnerable to MITM. Panel authentication tokens exposed.

Remediation

Enable TLS verification by default. Full report available.