EUVD-2026-63668
GHSA-8r62-w5wh-fc5m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-initiated browser attack requires no authentication but mandates victim page visit (UI:R); high confidentiality from email stream disclosure; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures websocket.Upgrader.CheckOrigin to return true. A malicious website can request /%61pi/events, skip corsOriginAccessControl(), reach the /api/events WebSocket handler, and receive live message IDs, Message-Id values, sender and recipient fields, subjects, tags, and body snippets from an unauthenticated default Mailpit instance after the user visits the site. This is a regression of the earlier WebSocket origin protection and does not affect deployments protected by --ui-auth-file. This issue is fixed in version 1.30.6.
AnalysisAI
Cross-site WebSocket hijacking in Mailpit 1.29.0-1.30.5 exposes live email metadata to any website the developer visits, due to a percent-encoding bypass in the origin-check middleware. The origin guard inspects the raw RequestURI for an /api/ prefix, but Go's ServeMux routes on the percent-decoded path - so a request to /%61pi/events skips the guard and reaches the /api/events WebSocket handler, whose upgrader unconditionally accepts every origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three of the following: (1) a Mailpit instance running version 1.29.0-1.30.5 without `--ui-auth-file` authentication - the default configuration; (2) the instance must be reachable from the victim's browser, which is satisfied by the default localhost binding when the victim is the developer running Mailpit; and (3) the victim must actively visit an attacker-controlled web page while Mailpit is running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) accurately reflects the attack surface: network-reachable and unauthenticated, but requiring the victim to visit an attacker-controlled page, with high confidentiality impact and no integrity or availability effects. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer runs Mailpit v1.29.0-1.30.5 locally in default configuration (no `--ui-auth-file`) and visits a malicious webpage - perhaps embedded in a compromised npm package's postinstall script or a phishing link. The page opens a JavaScript WebSocket to `http://localhost:8025/%61pi/events`; the raw-URI origin check is bypassed, Go's ServeMux routes the decoded path to `/api/events`, and the upgrader accepts the connection. … |
| Remediation | Upgrade to Mailpit v1.30.6, which fixes the vulnerability by switching the origin middleware from `r.RequestURI` to `r.URL.Path` (the percent-decoded path) and injecting `corsOriginAccessControl` directly into `websocket.Upgrader.CheckOrigin` via the new `SetCheckOriginFunc` mechanism, so the check can no longer be bypassed by encoding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Mailpit versions up to 1.28.2 contains a vulnerability that allows attackers to intercept sensitive data such as email c
Mailpit versions 1.28.0 and earlier contain a server-side request forgery vulnerability in the /proxy endpoint that perm
Mailpit versions prior to 1.29.2 contain a Server-Side Request Forgery vulnerability in the Link Check API that allows u
Mailpit versions before 1.28.3 contain a server-side request forgery vulnerability in the HTML Check feature that allows
Header injection in Mailpit's SMTP server prior to version 1.28.3 allows unauthenticated remote attackers to inject or m
Memory exhaustion in Mailpit's SMTP server (versions 1.30.0 through 1.30.4) allows unauthenticated remote SMTP clients t
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today