Email Address Validation Flaw in aiosmtplib by Cole

CVE-2026-90467

What is CVE-2026-90467?

The aiosmtplib library prior to version 5.1.3 contains a vulnerability due to improper validation of email addresses. This flaw allows attackers to inject malicious ESMTP parameters into the MAIL FROM and RCPT TO command lines, enabling them to forge authenticated identities or elicit delivery notifications to unrelated third parties. Attackers can exploit this vulnerability by crafting email addresses that include spaces and angle brackets, thus appending malicious parameters like AUTH, NOTIFY, or ORCPT. This could lead to unauthorized actions within the email delivery process, substantially compromising sender identity and notification mechanisms.

References