EUVD-2026-88599
GHSA-fvpv-g9f4-87fc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated over SMTP (AV:N/PR:N/UI:N); integrity-only spoofing outcome (I:L) with no confidentiality or availability impact; AC:L though real success is libspf2-version dependent.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc/opendmarc_spf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c48a74c758677fc5272a73eff15ffdbf8afda1a6. Applying a patch is the recommended action to fix this issue.
AnalysisAI
Email authentication bypass in OpenDMARC up to 1.4.2 allows remote unauthenticated attackers to spoof sender domains by exploiting a misordered domain-setting sequence in the SPF Macro Handler, causing SPF-backed DMARC checks to evaluate the attacker-controlled HELO domain instead of the envelope MAIL FROM domain. Publicly available exploit code exists, though successful exploitation depends on the libspf2 version (some versions treat the first-set domain as the SPF check domain). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a target running OpenDMARC ≤1.4.2 with its libspf2-based SPF checking active (SPF Macro Handler in opendmarc_spf.c performing opendmarc_spf2_test). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-to-medium severity email-authentication flaw, not a critical one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix from commit c48a74c758677fc5272a73eff15ffdbf8afda1a6, available through pull request #328 on the OpenDMARC GitHub repository; this is the primary remediation, though a released patched version (e.g., a tagged release) is not independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse
OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c. Rated h
OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applicati
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: a
DMARC authentication bypass in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote attacker defeat the DMARC an
Integer overflow in OpenDMARC through 1.4.2 allows unauthenticated remote attackers to corrupt DMARC policy-percentage h
DMARC policy evaluation in Trusted Domain Project OpenDMARC through 1.4.2 can be bypassed by mail carrying sending-domai
OpenDMARC through 1.4.2 can mishandle Internationalized Domain Name labels during DMARC policy lookup in opendmarc_polic
Malformed DMARC policy tags (fo, rf, ri, pct, sp, adkim, aspf, rua, ruf) supplied in attacker-controlled DNS TXT records
Off-by-one bounds error in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote, unauthenticated attacker send a
A NULL pointer dereference in the Trusted Domain Project's OpenDMARC (up to and including 1.4.2) can crash the mail filt
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about t
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today