Scbe Aethermoore
Monthly
The AetherBrowser API server shipped with SCBE-AETHERMOORE versions 4.0.2 through 4.2.0 exposes the POST /api/ops/check-email endpoint with no authentication check whatsoever, letting any remote, unauthenticated attacker invoke the email_reader.py subprocess, which logs into configured ProtonMail or Gmail accounts over IMAP and returns email metadata (sender, subject, and body snippets) in the JSON response. The server listens on 0.0.0.0:8100 by default and sets CORS allow_origins=["*"], so the endpoint is reachable from any network host and callable from any browser origin, though meaningful mailbox disclosure requires that IMAP credentials have actually been configured for the reader. Version 4.2.1 resolves the missing authentication (CWE-306); no public exploit code has been identified at time of analysis.
The AetherBrowser API server shipped with SCBE-AETHERMOORE versions 4.0.2 through 4.2.0 exposes the POST /api/ops/check-email endpoint with no authentication check whatsoever, letting any remote, unauthenticated attacker invoke the email_reader.py subprocess, which logs into configured ProtonMail or Gmail accounts over IMAP and returns email metadata (sender, subject, and body snippets) in the JSON response. The server listens on 0.0.0.0:8100 by default and sets CORS allow_origins=["*"], so the endpoint is reachable from any network host and callable from any browser origin, though meaningful mailbox disclosure requires that IMAP credentials have actually been configured for the reader. Version 4.2.1 resolves the missing authentication (CWE-306); no public exploit code has been identified at time of analysis.