Read the docs
TI-2026-69503 Aliases CVE-2026-104659

Origin validation error in hMailServer lets attackers brute-force admin password

Priority LOW 34CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

Progressive Robot hMailServer from 6.0.0 before 6.3.6 has a missing Host header check and no throttling of failed administrator sign-ins in its REST API listener. A remote attacker can use DNS rebinding to make a web page opened in a browser on the server send requests to the listener, which is off by default, and try administrator passwords without delay until one is accepted, giving full administrative control of the mail server. The flaw is classified as CWE-346.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00143 3rd percentileScored 2026-11-07
Fix Fixed hMailServer (Progressive Robot Ltd): 6.3.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Progressive Robot LtdhMailServer6.0.0 to before 6.3.66.3.6Patch availableCNA
  • hMailServer VendorProgressive Robot Ltd Affected 6.0.0 to before 6.3.6 Fixed in 6.3.6 Patch available CNA

Remediation

Update hMailServer to version 6.3.6, which is the fixed version listed for this product. CISA does not list this vulnerability in its Known Exploited Vulnerabilities catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA hMailServer (Progressive Robot Ltd) Fixed in 6.3.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Progressive Robot hMailServer 6.3.6

    23 records Highest priority Priority LOW 23 LOW

    Other records, highest priority first

    • TI-2026-69567 Inefficient processing in hMailServer stalls mail deliveryPriority LOW 39
    • TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mailPriority LOW 39
    • TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of servicePriority LOW 39
    Show all 23 records →

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-104659

References

Other 2

  • TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
  • TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
  • TI-2026-69567 Inefficient processing in hMailServer stalls mail delivery CVSS 3.1HIGH 7.5
  • TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mail CVSS 3.1HIGH 7.5
  • TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
  • TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences