OpenDMARC Authentication and Policy Bypass Flaws

Email authentication bypass in OpenDMARC up to 1.4.2 allows remote unauthenticated attackers to spoof sender domains by exploiting a misordered domain-setting sequence in the SPF Macro Handler, causing SPF-backed DMARC checks to evaluate the attacker-controlled HELO domain instead of the envelope MAIL FROM domain. Publicly available exploit code exists, though successful exploitation depends on the libspf2 version (some versions treat the first-set domain as the SPF check domain). This is a low-to-medium severity email-authentication flaw with no confidentiality or availability impact, only limited integrity impact.

DMARC authentication bypass in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote attacker defeat the DMARC anti-spoofing check by supplying a multi-record DMARC TXT set that the Multi-Record Set Handler evaluates more permissively than RFC 7489 requires. The affected mail server must run OpenDMARC as its DMARC verifier and the attacker must control or influence DNS for the spoofed sender domain; no credentials or user interaction are required (PR:N/UI:N), though the resulting impact is limited to forged mail passing DMARC rather than host compromise. Publicly available exploit code exists, the vendor was contacted early and did not respond, and no vendor-released patch was identified at time of analysis.

Integer overflow in OpenDMARC through 1.4.2 allows unauthenticated remote attackers to corrupt DMARC policy-percentage handling by supplying a crafted 'pct=' value in a DMARC DNS TXT record. Publicly available exploit code exists, but the vulnerability is not confirmed actively exploited (CISA KEV). Exploitation requires the target to be actively performing DMARC verification on inbound mail and the attacker to control a queried domain's DMARC record; assessed impact is limited to integrity of policy-percentage handling and minor availability disruption, not RCE or data disclosure.

Origin validation error in OpenDMARC through version 1.4.2 lets remote attackers trigger incorrect organizational-domain extraction by sending mail from a specially crafted domain, potentially undermining DMARC alignment and allowing spoofed messages to evade DMARC-based filtering. The flaw carries a CVSS 4.0 base score of 5.3 and affects integrity only; publicly available exploit code exists, but there is no confirmation of active exploitation, and the vendor did not respond to disclosure so no official patch is available.