EUVD-2026-94834
GHSA-7264-4fp3-6f67
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:N and PR:N because the attack originates from a remote page needing no listener credentials; AC:H for the DNS-rebinding race; UI:R because a privileged admin must open the page on the server; C/I/A:H for full admin takeover.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server.
AnalysisAI
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to brute-force the server administrator's password through the administrator's own browser when the optional REST API listener is enabled, ultimately gaining full administrative control of the mail server. Two flaws combine to enable this: the listener answers requests regardless of the Host header they carry, and failed administrator sign-ins originating from the loopback address are neither throttled nor auto-banned, so a rebound page can submit password attempts at full speed until one is accepted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the operator has explicitly enabled hMailServer's REST API listener (it is OFF BY DEFAULT and, when on, bound to the loopback interface 127.0.0.1); that a server administrator opens an attacker-controlled web page in a browser running ON the server host itself; and that the attacker controls DNS for a hostname they can rebind to 127.0.0.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional High-severity issue rather than a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 6.3.6 - upgrade hMailServer to 6.3.6 (https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6), which addresses the missing Host header validation and the missing throttling/auto-ban on loopback administrator sign-ins described in https://gitlab.com/hmailserver/hmailserver/-/work_items/57. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every hMailServer 6.0.0-6.3.5 installation and determine which ones have the optional REST API listener enabled; where it is not actively required, stop the hMailServer service and disable the REST API listener entirely, since no vendor-released patch has been identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker exe
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation c
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today