CVE-2026-57443

SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=["*"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.

• CWE-306

• https://github.com/issdandavis/SCBE-AETHERMOORE/commit/ca833795e01eab060e92572e5f667c0c136b8c1e
• https://github.com/issdandavis/SCBE-AETHERMOORE/commit/de7779b722c501dbcf4eae95dd51bb3984506fb1
• https://github.com/issdandavis/SCBE-AETHERMOORE/security/advisories/GHSA-q986-4x7x-gx39

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57437Nokogiri is an open source XML and HTML library for the Ruby…5.3
• CVE-2026-57438Nokogiri is an open source XML and HTML library for the Ruby…6.6
• CVE-2026-57439CyberChef is a web app for encryption, encoding, compression…5
• CVE-2026-57440The EmbedVideo Extension is a MediaWiki extension which adds…7.5
• CVE-2026-57441MCPVault is a lightweight Model Context Protocol server for …8.4
• CVE-2026-57442MCPVault is a lightweight Model Context Protocol server for …6.9
• CVE-2026-57445Gardens v2 is a modular governance framework that enables co…8.7
• CVE-2026-57449Actual is a local-first personal finance tool. Prior to 26.7…7.1
• CVE-2026-5745A flaw was found in libarchive. A NULL pointer dereference v…5.5
• CVE-2026-57451Vim is an open source, command line text editor. Prior to 9.…6.1
• CVE-2026-57452Vim is an open source, command line text editor. Prior to 9.…5.5
• CVE-2026-57453Vim is an open source, command line text editor. From 9.1.17…7.3