CVE-2026-114473 in hMailServer
Summary
by MITRE • 10/21/2026
Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at the forwarding domain, and passes a bounce to that address back to the original sender; but it took every message to a valid SRS address, whatever its sender, as delivery to a local recipient, so the relay rules and the SMTP authentication they require were not applied, and the message was delivered to the outside address the SRS address encodes. Anyone holding a valid SRS address of the server, such as the recipient of a forwarded message, could have the server relay mail to the address it encodes for 21 days, and an account holder whose account forwards to an outside mailbox could obtain one for any address. SRS is off by default.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Progressive Robot hMailServer versions 6.2.1 through 6.3.6 represents a critical failure in access control logic within the Sender Rewriting Scheme implementation. The Sender Rewriting Scheme is designed to preserve email deliverability when messages are forwarded across different domains by rewriting the envelope sender address into a format that allows bounce messages to be routed back to the original sender. In this specific instance, the server's authorization mechanism fails to distinguish between legitimate forwarding operations and unauthorized relay attempts. Specifically, the software incorrectly treats any message addressed to a valid SRS-encoded address as if it were destined for a local recipient. This misclassification bypasses the standard SMTP authentication requirements and relay restrictions that are typically enforced when sending mail to external domains. Consequently, an attacker can exploit this logic flaw to force the server to deliver emails to arbitrary outside addresses without requiring proper credentials or adhering to configured anti-relay policies.
From a technical perspective, the core issue lies in how hMailServer processes incoming SMTP transactions directed at SRS addresses. When SRS is enabled, the system generates signed addresses that encode destination information for bounce handling. However, the validation routine does not verify whether the sender of such a message has permission to use that specific forwarding path or if they are authorized to relay mail through the server. Instead, it assumes local delivery authority based solely on the validity of the SRS token itself. This allows any entity possessing a valid SRS address for the domain to utilize the server as an open relay for up to twenty-one days, which is the typical expiration period for such tokens. Furthermore, users with accounts configured to forward mail to external addresses can generate these SRS tokens for arbitrary destinations, effectively granting them unrestricted relay capabilities across any target domain. This behavior fundamentally undermines the security model of the mail server by decoupling delivery actions from authentication and authorization checks.
The operational impact of this vulnerability is severe, primarily facilitating spam distribution and potential phishing campaigns. By allowing remote attackers to relay mail through hMailServer instances without authentication, the vulnerability transforms compromised or misconfigured servers into powerful tools for mass email dispatching. Attackers can leverage these open relays to send unsolicited bulk emails, which not only degrades network performance but also risks blacklisting the server's IP address and domain reputation with major internet service providers. Additionally, the ability to spoof origins by exploiting bounce routing mechanisms may aid in sophisticated social engineering attacks where email headers are manipulated to appear legitimate while actually originating from an untrusted relay point. The fact that SRS is disabled by default mitigates exposure for many installations, but organizations that have explicitly enabled this feature for forwarding functionality remain at significant risk if they do not apply immediate patches or implement compensating controls.
To mitigate the risks associated with CVE-2013-4698 and similar authorization flaws in mail servers, administrators should ensure that hMailServer is updated to a version where this logic error has been corrected. In environments where upgrading is not immediately feasible, disabling the Sender Rewriting Scheme feature can eliminate the attack vector entirely, although this may impact bounce handling for forwarded messages. It is also advisable to enforce strict SMTP authentication requirements on all relay paths and to implement network-level controls such as rate limiting or IP-based access control lists that restrict outbound mail delivery to authenticated users only. From a classification standpoint, this vulnerability aligns with CWE-269 Improper Privilege Management and falls under the MITRE ATT&CK technique of T1571 Non-Standard Port for C2 channels if used for covert communication, or more broadly as part of email relay abuse strategies often seen in spam operations. Regular auditing of mail server configurations against industry standards like CIS Benchmarks can help identify such misconfigurations before they are exploited by malicious actors seeking to leverage infrastructure for illicit communications.