hMailServer CVE-2026-114471

Exploitation requires SMTP logging to be explicitly enabled (it is OFF by default) so the SASL exchange is written to disk, PLUS local read access to the server's log files. Credentials are exposed when the client uses AUTH PLAIN sent before EHLO or with non-standard spacing, AUTH XOAUTH2 or AUTH OAUTHBEARER bearer tokens (6.2.0+), AUTH SCRAM-SHA-256 (client proof plus logged salt/iteration count enabling offline guessing, 6.2.0+), or GSSAPI (6.3.2+); the one exact post-EHLO AUTH PLAIN form is correctly masked. Limiting factors: non-default logging, local access requirement, and high attack complexity. On Windows before 6.3.6 the barrier is lower because the log folder is readable by every local user; a correctly-formed AUTH PLAIN after EHLO is NOT exposed.

This is a genuine but low-urgency issue, correctly rated medium (CVSS 4.7). All signals point the same direction: the CVSS vector (AV:L/AC:H/PR:L/UI:N/C:H/I:N/A:N) describes a local, high-complexity, authenticated information-disclosure flaw with confidentiality-only impact - not a remotely weaponizable bug. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, so no exploitation-probability signal is available to contradict the low-severity picture. No SSVC decision data was provided. The AC:H and PR:L metrics are well justified because exploitation requires SMTP logging to be enabled (off by default) AND local read access to the log directory. The real-world risk is amplified only on Windows installations before 6.3.6, where the log folder was world-readable by every local user, lowering the effective barrier - but this still requires a local foothold plus non-default logging. No key data is conflicting; the main gap is the absence of EPSS/KEV/POC telemetry, which is consistent with a recently disclosed, low-severity local flaw rather than evidence of safety.

On a hMailServer host (6.0.0-6.3.6) where an administrator has enabled SMTP logging, a local user - or anyone handed a copy of the log files - reads the SASL authentication exchanges that the server wrote verbatim, recovering cleartext PLAIN passwords, OAuth 2.0 bearer tokens, SCRAM client proofs (usable with the logged salt/iteration count for offline cracking), or GSSAPI data. On Windows before 6.3.6 this is trivial because the log folder is readable by every local account. No public exploit is identified; exploitation is high-complexity (AC:H) and requires local access.