Auto-ban Bypass Vulnerability in hMailServer by Progressive Robot
CVE-2026-126616

5.3MEDIUM

Key Information:

Vendor

Progressive Robot Ltd

Status
Hmailserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126616?

The auto-ban functionality in hMailServer versions 6.2.0 through 6.3.3 is susceptible to a flaw that allows remote unauthenticated attackers to bypass restrictions on failed logon attempts. This weakness arises when the server fails to properly handle user names containing non-Basic Multilingual Plane characters, leading to ineffective banning of IP addresses that exceed the allowed number of login failures. In structured configurations with MySQL or MariaDB, malicious users can exploit this gap, circumventing security measures and brute-forcing credentials without facing bans. Such vulnerabilities can expose the system to heightened risk of unauthorized access, significantly undermining overall security.

Affected Version(s)

hMailServer 6.2.0 <= 6.3.3

References

https://gitlab.com/hmailserver/hmailserver/-/work_items/103
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.4

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Found by the hMailServer project (Progressive Robot Ltd)
.