CVE-2026-104659

Summary

The Progressive Robot hMailServer has a critical flaw in its REST API listener that allows remote attackers to brute-force administrator passwords through DNS rebinding attacks. The vulnerability occurs because the server accepts requests regardless of Host header values and doesn't throttle failed login attempts, enabling attackers to send authenticated requests from the victim's browser at full speed.

Exploitability

Exploitation requires DNS rebinding to redirect a web page to 127.0.0.1, with the attacker's page running in the victim's browser that has access to the REST API listener, making it moderately difficult but achievable with a bit of social engineering.

Blast radius

If exploited, attackers could gain full administrative control over the mail server, potentially compromising all email accounts and data stored on the server.

Detection

Monitor for failed authentication attempts from loopback interface (127.0.0.1) with high frequency and lack of rate limiting, particularly in logs related to REST API access.

Prioritized remediation

Disable the REST API listener in hMailServer configuration or upgrade to version 6.3.6 or later which fixes this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.