Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
Priority MEDIUM 43CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Fix Fixed webmail (bulwarkmail): 1.4.10
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bulwarkmail | webmail | before 1.4.10 | 1.4.10 | Patch available | CNA |
- webmail Vendorbulwarkmail Affected before 1.4.10 Fixed in 1.4.10 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bulwarkmail:webmail:*:*:*:*:*:*:*:* | before 1.4.10 | Vulnerable | bulwarkmail |
- cpe:2.3:a:bulwarkmail:webmail:*:*:*:*:*:*:*:* Versions before 1.4.10 Vulnerable ·bulwarkmail
Remediation
- Fix · CNA webmail (bulwarkmail) Fixed in 1.4.10
Timeline
- 2026-10-02 Threatist record created from CVE-2026-34834
References
More bulwarkmail Webmail vulnerabilities
- TI-2026-27077 Bulwark Webmail: Information Exposure: password returned in /api/auth/session CVSS 4.0HIGH 8.7
- TI-2026-27527 Bulwark Webmail getClientIP() trusted client-controlled X-Forwarded-For value, enabling… CVSS 4.0HIGH 8.7
- TI-2026-27525 Bulwark Webmail S/MIME signature verification accepted self-signed certificates CVSS 4.0HIGH 8.7
- TI-2026-27526 Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks CVSS 4.0MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences