Billionmail
Monthly
Unauthenticated attackers can forge unsubscribe and subscribe-confirmation JWTs against BillionMail through version 4.9 because the token signing key is deterministically computed from default configuration constants that ship with the project. By submitting forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm, an attacker who knows the target contact identifier (e.g. an email address) can deactivate that contact or force a subscription to be confirmed. The flaw is remotely reachable with no authentication (CVSS vector PR:N) and no user interaction; there is confirmed KEV status? No - it is not in CISA KEV and no public exploit identified at time of analysis, impact is confined to integrity and availability of subscription state, making this a genuine but moderate-priority issue rather than a critical one.
Unauthenticated attackers can forge unsubscribe and subscribe-confirmation JWTs against BillionMail through version 4.9 because the token signing key is deterministically computed from default configuration constants that ship with the project. By submitting forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm, an attacker who knows the target contact identifier (e.g. an email address) can deactivate that contact or force a subscription to be confirmed. The flaw is remotely reachable with no authentication (CVSS vector PR:N) and no user interaction; there is confirmed KEV status? No - it is not in CISA KEV and no public exploit identified at time of analysis, impact is confined to integrity and availability of subscription state, making this a genuine but moderate-priority issue rather than a critical one.