https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 03:09:03 +0000 https://db.gcve.eu/vuln/cve-2026-107567 <p><strong>Affected:</strong> Progressive Robot Ltd hMailServer</p> <p>Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message&#39;s origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain&#39;s key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain&#39;s DMARC policy: an account&#39;s forward, a mail rule&#39;s forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain&#39;s key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain&#39;s mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain…</p> <p><strong>Affected:</strong> Progressive Robot Ltd hMailServer</p> <p>Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message&#39;s origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain&#39;s key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain&#39;s DMARC policy: an account&#39;s forward, a mail rule&#39;s forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain&#39;s key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain&#39;s mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain…</p> https://db.gcve.eu/vuln/cve-2026-107567