Authentication Vulnerability in Bulwark Webmail by Stalwart
CVE-2026-34833

8.7HIGH

Key Information:

Vendor

Bulwarkmail

Status
Webmail
Vendor
CVE Published:
2 April 2026

What is CVE-2026-34833?

The Bulwark Webmail client, used with the Stalwart Mail Server, has a significant flaw where user credentials were exposed through the API. Specifically, prior to version 1.4.10, the GET /api/auth/session endpoint returned plaintext passwords in its JSON responses. This serious issue allowed malicious actors to access sensitive information through browser logs, local caches, and network proxies. Users are strongly encouraged to upgrade to the patched version 1.4.10 to mitigate this vulnerability.

Affected Version(s)

webmail < 1.4.10

References

https://github.com/bulwarkmail/webmail/security/advisorie...
x_refsource_CONFIRM
https://github.com/bulwarkmail/webmail/releases/tag/1.4.10
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.