Certificate Validation has been disabled. The communication could be intercepted.

Risk

Disabling certificate validation is often used to connect easily to a host that is not signed by a root certificate authority. As a consequence, this is vulnerable to Man-in-the-middle attacks since the client will trust any certificate.

Vulnerable Code

    ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, sslPolicyErrors) => true;

Solution

Using sign certificate.

References

WASC-04: Insufficient Transport Layer Protection
CWE-295: Improper Certificate Validation