Account Authentication Bypass in hMailServer by Progressive Robot
CVE-2026-126615

5.3MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126615?

The hMailServer authentication mechanism contains a vulnerability that allows remote unauthenticated attackers to bypass account lockouts and conduct unlimited password guessing attempts. The issue lies within how account names are processed, enabling attackers to access accounts through various alternate spellings. This flawed implementation permits attackers to exploit the thresholds for lockouts and compromised-account holds, which can be circumvented by using different spellings that the database recognizes. This may lead to unauthorized access to accounts, particularly affecting systems that utilize specific databases like MySQL, MariaDB, SQL Server, and PostgreSQL. It is crucial for users of affected versions to implement immediate security measures to mitigate these risks.

Affected Version(s)

hMailServer 6.2.22-pre2 <= 6.3.7

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/104
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found by the hMailServer project (Progressive Robot Ltd)
.