Bulwark Webmail: Information Exposure: password returned in /api/auth/session
Priority MEDIUM 43CWE-312Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312.
Summary
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00173 6th percentileScored 2026-11-07
Fix Fixed webmail (bulwarkmail): 1.4.10
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bulwarkmail | webmail | before 1.4.10 | 1.4.10 | Patch available | CNA |
- webmail Vendorbulwarkmail Affected before 1.4.10 Fixed in 1.4.10 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bulwarkmail:webmail:*:*:*:*:*:*:*:* | before 1.4.10 | Vulnerable | bulwarkmail |
- cpe:2.3:a:bulwarkmail:webmail:*:*:*:*:*:*:*:* Versions before 1.4.10 Vulnerable ·bulwarkmail
Remediation
- Fix · CNA webmail (bulwarkmail) Fixed in 1.4.10
Timeline
- 2026-10-02 Threatist record created from CVE-2026-34833
References
More bulwarkmail Webmail vulnerabilities
- TI-2026-27078 Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation CVSS 4.0HIGH 8.7
- TI-2026-27527 Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling… CVSS 4.0HIGH 8.7
- TI-2026-27525 Bulwark Webmail S/MIME signature verification accepted self-signed certificates CVSS 4.0HIGH 8.7
- TI-2026-27526 Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks CVSS 4.0MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences