EUVD-2026-88595
GHSA-fwhq-23fv-8x97
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated multi-record DMARC downgrade needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); impact is integrity-only spoofing (I:L) with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
DMARC authentication bypass in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote attacker defeat the DMARC anti-spoofing check by supplying a multi-record DMARC TXT set that the Multi-Record Set Handler evaluates more permissively than RFC 7489 requires. The affected mail server must run OpenDMARC as its DMARC verifier and the attacker must control or influence DNS for the spoofed sender domain; no credentials or user interaction are required (PR:N/UI:N), though the resulting impact is limited to forged mail passing DMARC rather than host compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target mail server run OpenDMARC (<=1.4.2) as its DMARC verifier and that the attacker be able to serve or influence multiple DMARC TXT records for the spoofed sender's domain (i.e., control that domain's DNS or an on-path DNS response). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderate and internally consistent, pointing to a real but low-impact email-authentication weakness rather than a top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, and the vendor did not respond to early notification, so remediation must be compensating rather than version-based. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse
OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c. Rated h
OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applicati
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: a
Email authentication bypass in OpenDMARC up to 1.4.2 allows remote unauthenticated attackers to spoof sender domains by
Integer overflow in OpenDMARC through 1.4.2 allows unauthenticated remote attackers to corrupt DMARC policy-percentage h
DMARC policy evaluation in Trusted Domain Project OpenDMARC through 1.4.2 can be bypassed by mail carrying sending-domai
OpenDMARC through 1.4.2 can mishandle Internationalized Domain Name labels during DMARC policy lookup in opendmarc_polic
Malformed DMARC policy tags (fo, rf, ri, pct, sp, adkim, aspf, rua, ruf) supplied in attacker-controlled DNS TXT records
Off-by-one bounds error in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote, unauthenticated attacker send a
A NULL pointer dereference in the Trusted Domain Project's OpenDMARC (up to and including 1.4.2) can crash the mail filt
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about t
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today