Insufficient Sender Preservation Vulnerability in hMailServer by hMailServer

CVE-2026-114478

What is CVE-2026-114478?

An insufficient preservation of the original sender during the email forwarding process in hMailServer versions 6.0.0 through 6.3.6 can allow remote unauthenticated attackers to manipulate the From address of messages. This enables attackers to have emails they write appear as legitimate, passing the DMARC policy of the host domain. The vulnerability occurs when emails are forwarded, redirected, or aliased, which can result in the preservation of misleading SMTP identities. The exploitation requires specific server configurations to be in place, including enabling mechanisms like Sender Rewriting Scheme (SRS) or envelope rewriting. By doing so, it allows the email to pass SPF checks, thereby bypassing intended email authentication measures.

References