WebSocket Vulnerability in Mailpit Email Testing Tool by Axllent

CVE-2026-67448

What is CVE-2026-67448?

Mailpit, an email testing tool developed by Axllent, is susceptible to a CORS bypass vulnerability in versions 1.29.0 through 1.30.6. A flaw in the middleware allows an attacker to exploit the /api/events endpoint via a malicious website, enabling unauthenticated access to sensitive data such as message IDs, sender and recipient details, and message content. This vulnerability arises because the incoming request URI handling does not match the expected security checks for WebSocket connections, specifically the origin protection that was previously in place. The issue is resolved in the latest release, version 1.30.6, and deployments that use the --ui-auth-file option are not affected.

References