Remote Authentication Bypass in Progressive Robot hMailServer
CVE-2026-126614

5.3MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126614?

The web services listener in Progressive Robot hMailServer versions 6.3.3 through 6.3.7 is susceptible to a flaw that permits remote, unauthenticated attackers to repeatedly attempt password guessing on user accounts. Despite an auto-ban feature designed to restrict access after multiple failed logins, the listener accepts connections without appropriately applying server IP range restrictions. As a result, attackers can exploit this flaw to bypass the account lockout mechanism, continuing their unauthorized attempts without being blocked. This critical oversight can significantly increase the risk of unauthorized access to user accounts. Proper mitigation involves configuring the listener settings and employing robust firewall rules to safeguard the server.

Affected Version(s)

hMailServer 6.3.3 <= 6.3.7

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/105
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found by the hMailServer project (Progressive Robot Ltd)
.