Live › vulnerability › CVE-2026-114471
Go to dashboardhMailServer writes parts of SMTP AUTH exchanges into its SMTP log, including PLAIN passwords sent in some forms, OAuth bearer tokens, SCRAM client proofs and GSSAPI data. Anyone who can read that log, or gets a copy of it, can take those credentials or guess the password offline.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only hMailServer installs in the range 6.0.0 through 6.3.6 with SMTP logging turned on are exposed, since logging is off by default. Servers on 6.3.6 or later, or with logging disabled, can skip this; the Windows folder exposure applies to any affected Windows host regardless of who runs the mail service.
No product ranges from the sources yet.
hMailServer version in the Administrator) against the affected range 6.0.0 through 6.3.6.6.3.6 or later, which fixes the log folder permissions on Windows.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH PLAIN command only when it was sent after EHLO in one exact form, and wrote the rest of the SASL exchange as the client sent it: a PLAIN password sent before EHLO or with extra spacing, the OAuth 2.0 bearer token of AUTH XOAUTH2 and AUTH OAUTHBEARER (from 6.2.0), the SCRAM-SHA-256 client proof (from 6.2.0), which with the logged salt and iteration count allows offline password guessing, and the GSSAPI authenticator (from 6.3.2). SMTP logging is off by default; on Windows before 6.3.6 the log folder was readable by every local user.
This page as .md · .json · in your agent: get_signal("CVE-2026-114471")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.