CVE-2017-16905: Duolingo Tinycards

High severity, CVSS 8.1. EPSS: 3.5% chance of exploitation in the next 30 days.

The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-the-middle attack.

Affected products

• Duolingo Tinycards: before 1.0 (fixed in 1.0)

Published 2018-01-05. Last modified 2026-06-17.