---
id: "CVE-2026-114470"
kind: "vulnerability"
aliases: ["CVE-2026-114470"]
title: "hMailServer: cross-site requests ride cached Basic credentials to the REST API"
severity: "medium"
cvss: 5.3
epss: 0.00153
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["hmailserver", "mail-server", "package", "self-hosted"]
not_affected_if: ["default-config", "patched-release"]
published_at: "2026-10-21T16:17:34+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:20:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114470", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114470", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# hMailServer: cross-site requests ride cached Basic credentials to the REST API

The hMailServer REST API accepts HTTP Basic authentication, and browsers cache that credential and send it on cross-site form posts, so the existing cross-site protection does not cover it. A malicious page visited by a logged-in administrator can make the browser create domains, accounts, API keys or change settings, though the attacker cannot read the responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the hMailServer version in the installed package or service, e.g. `hmailserver --version` or the install's version file: unknown
- Check whether the REST API is enabled and reachable from a browser on an administrator's workstation: unknown

## Fix

- Upgrade hMailServer to a release after `6.3.6`: unknown exact fixed version in the sources
- Until patched, restrict REST API access to trusted networks and avoid browsing the web while signed in to the API in the same browser: unknown

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114470
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114470

## From the sources

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a browser caches the credential once the box is answered and sends it with later requests to that origin, including a top-level form post from another site, and the server reads a request body whatever its declared content type. The cross-site protection covered only the cookie session (a header a cross-site form cannot set, and a SameSite=Strict cookie); HTTP Basic was not held to it. A page under an attacker's control, visited by a user whose browser holds a cached Basic credential for the REST API - typically an administrator who signed in through the box - could therefore cause a state-changing request such as creating a domain, an account or an API key, or changing a setting, with the victim's credential. The attacker cannot read the cross-origin response, so the forgery is blind.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_