CVE-2026-126614

The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it accepts, which allows a remote unauthenticated attacker to go on guessing account passwords at the listener's sign-ins after the auto-ban has banned the attacker's address. The listener is off by default (WebServicesHttpPort and WebServicesHttpsPort 0). From 6.3.3 its CardDAV, and from 6.3.4 its CalDAV and its Outlook Autodiscover answer to a request that carries credentials, sign an account in with HTTP Basic over HTTPS. A failed sign-in there counts towards the auto-ban as a failed logon on any other protocol does: when the failures counted from one address reach MaxInvalidLogonAttempts (3 within 30 minutes by default), the server writes an IP range that refuses the address for AutoBanMinutes (60 by default), and the SMTP, POP3, IMAP and ManageSieve listeners refuse it. The web services listener asked no IP range when it accepted a connection (in 6.3.3 nothing, from 6.3.4 the country policy alone), so it went on serving such an address, whether its ban had been earned there or on another protocol, and also an address that an administrator's IP range allowing nothing holds. Each failed sign-in there closed only its own connection, and the next connection was accepted, during the ban and after it. The firewall rule and command the auto-ban can drive (AutoBanFirewall and AutoBanCommand, off by default) are told only the SMTP, POP3 and IMAP ports, so that the firewall rule and the packaged hook did not close the listener's ports, and the fail2ban jail packaged for Linux (off by default) lists only the mail and ManageSieve ports. The only limit left on the guesses at one account there was the per-name lockout (AccountLockoutThreshold in hMailServer.ini, 0, off, by default), which has a separate defect fixed in the same release. The flaw is reached on the listener's HTTPS port: behind a TLS-terminating proxy the listener sees the proxy's address for every client, and a ban never named the client there.

• CWE-307

• https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8
• https://gitlab.com/hmailserver/hmailserver/-/work_items/105

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126609Progressive Robot hMailServer 6.2.25 through 6.3.7 on Window…7.5
• CVE-2026-12661A denial-of-service security issue exists within FactoryTalk…4.8
• CVE-2026-126610Progressive Robot hMailServer 6.3.4 through 6.3.7, with a My…7.4
• CVE-2026-126611Progressive Robot hMailServer 6.3.4 through 6.3.7, with a My…7
• CVE-2026-126612Improper link resolution in the Windows installer of Progres…7.8
• CVE-2026-126613Allocation of resources without limits in the JSON reader of…7.5
• CVE-2026-126615The sign-in of Progressive Robot hMailServer 6.2.22-pre2 thr…5.3
• CVE-2026-126616The auto-ban of Progressive Robot hMailServer 6.2.0 through …5.3
• CVE-2026-126617SQL injection in the database layer of Progressive Robot hMa…8.8
• CVE-2026-126618The auto-ban of Progressive Robot hMailServer 6.0.0-B1 throu…5.3
• CVE-2026-126619Misinterpretation of SQL statement text in the database laye…4.8
• CVE-2026-126621Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Wind…7.5