Web Services Listener Vulnerability in Progressive Robot hMailServer

CVE-2026-126626

What is CVE-2026-126626?

The web services listener in Progressive Robot hMailServer versions 6.3.3 to 6.3.7 is vulnerable to an improper authentication issue that can be exploited by remote unauthenticated attackers. When fail attempts for CardDAV, CalDAV, or Autodiscover sign-ins occur through a trusted proxy, the server mistakenly associates these failed attempts with the proxy's address, leading to improper bans. This allows an attacker to block legitimate users by exploiting the auto-ban feature, affecting access to SMTP, POP3, IMAP, and ManageSieve listeners. The listener utilizes HTTP Basic authentication over HTTPS, which can further expose sensitive services when misconfigured. Additionally, this vulnerability is exacerbated in scenarios involving TLS-terminating proxies, potentially locking out all clients behind the compromised proxy.

References