OpenDMARC CVE-2026-101278

Requires an OpenDMARC deployment (version <=1.4.2) actively performing DMARC evaluation on inbound mail with Public Suffix List / organizational-domain lookup enabled (default behavior for DMARC alignment). The attacker must control or register a sender domain crafted to trigger the PSL wildcard-rule handling bug in opendmarc_get_tld(), then send email through the affected filter. Limiting factors: impact is confined to defeating the DMARC anti-spoofing control (Low integrity, no confidentiality/availability, no code execution); success depends on the target relying on OpenDMARC's verdict for delivery/quarantine decisions. Note the input vector claims PR:L, but inbound-mail evaluation typically needs no authentication - treat the privilege requirement as unverified.

This is a genuine but low-to-moderate-impact integrity flaw, not a high-urgency emergency. The CVSS 4.0 base is 5.3 (Medium) with a network vector, low complexity, no user interaction, and only Low integrity impact (VI:L) - no confidentiality or availability impact. A public exploit exists (E:P in the vector; POC confirmed), which raises real-world exploitability above a purely theoretical bug, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of widespread or automated exploitation - consistent with a security-control-bypass rather than a mass-exploited RCE. Two data-quality conflicts must be flagged: (1) the vendor/VulDB vector uses PR:L (authenticated), yet the vulnerability is an origin-validation flaw in evaluating INBOUND email, which normally requires no authentication for a remote sender to trigger - verify the privilege assumption with the researcher/vendor. (2) The 'Information Disclosure' tag is inconsistent with the actual impact: CWE-346 (Origin Validation Error) producing VI:L is an integrity/authentication-bypass issue (a spoofed message passing DMARC), not a confidentiality leak. The vendor was contacted early and did not respond, and no patch exists, which increases exposure duration for deployed instances.

An attacker crafts a sender domain that abuses OpenDMARC's Public Suffix List wildcard-rule handling in opendmarc_get_tld(), causing the filter to compute the wrong organizational domain and mis-evaluate DMARC identifier alignment. As a result, a spoofed or phishing email that should fail DMARC is instead treated as aligned/passing, defeating the anti-spoofing control and improving inbound phishing delivery. A public proof-of-concept demonstrating the PSL wildcard org-domain miscomputation has been published.