Live › vulnerability › CVE-2026-121452
bbs-go skips TLS certificate verification when it sends email through SMTP, so any party that can intercept the connection can impersonate the mail server. An attacker on the network path can capture SMTP login credentials and read or alter password-reset and verification emails.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Any self-hosted bbs-go forum that sends email over SMTP is exposed, since the flaw is in the outgoing mail code. An attacker needs a network position between the server and its mail provider, such as a shared network or a compromised route. Sites that do not send mail through bbs-go can skip it.
No product ranges from the sources yet.
4.4.6 are affected.InsecureSkipVerify: true in the Go source or build.4.4.6; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.
This page as .md · .json · in your agent: get_signal("CVE-2026-121452")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.