hMailServer CVE-2026-107585

Exploitation requires that the target hMailServer 6.3.4 or 6.3.5 deployment actually uses the REST API's federated or passwordless sign-in features - specifically OpenID Connect, SAML single sign-on, or passkey (WebAuthn) authentication - since the attack targets the pending-sign-in and passkey-challenge tables for those flows. The initiating routes are reachable without authentication (PR:N), so no credentials are needed, but the attacker must sustain a high request rate (about a hundred per second for passkeys) for the entire duration of the denial, and impact ceases when the flood stops. Deployments that do not enable OIDC/SAML/passkey sign-in, or that place the REST API behind rate-limiting or network restrictions, are not meaningfully affected; impact is limited to login availability and does not extend to confidentiality, integrity, or mail delivery.

This is a low-to-moderate priority availability issue, not a critical flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, score 5.3 MEDIUM) is internally consistent with the description: the single-sign-on initiation and passkey-challenge routes of the REST API are reachable remotely without authentication, with low attack complexity and no user interaction, and the impact is confined to availability (C:N/I:N) at the LOW level because it degrades a specific authentication path rather than crashing the server. No EPSS score, KEV listing, or POC was provided in the input, so by the precision rules this is 'no public exploit identified at time of analysis' - exploitation is plausible and technically simple (a sustained request flood of roughly a hundred requests per second for passkeys) but there is no evidence of active or automated exploitation in the wild. The practical risk is bounded: the attack only denies OpenID Connect, SAML, and passkey sign-ins while the flood continues, is trivially detectable as an abnormal request rate, stops when the traffic stops, and does not compromise data or achieve code execution. Net assessment: a real but self-limiting denial-of-service against SSO/passkey login, worth patching on normal cadence rather than as an emergency, and only relevant to deployments that actually use these federated/passkey sign-in methods.

An attacker who can reach the hMailServer REST API repeatedly calls the unauthenticated endpoints that start an SSO flow or request a passkey challenge, at roughly a hundred requests per second for passkeys. Because the bounded pending-sign-in tables evict their oldest entry when full regardless of owner, legitimate users' pending sign-in state is pushed out before their browser completes the round trip, so their OIDC, SAML, and passkey logins fail for as long as the flood lasts. No public exploit code is identified at time of analysis, but the attack requires only a simple HTTP request loop.