{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Mail Assure",
          "vendor": "N-able",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alessandro Bertoldi BCS via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CVE-2025-68624: Cross-Tenant Authentication Bypass by Spoofing in N-able Mail Assure\n\nCVE ID: CVE-2025-68624\nStatus: DISPUTED\nCWE: CWE-290 (Authentication Bypass by Spoofing)\nAffected Product: N-able Mail Assure (formerly SolarWinds MSP Mail Assure)\nAffected Service: N-able Mail Assure cloud-based multi-tenant SMTP relay infrastructure\nVendor: N-able Technologies\nInitial Discovery: October 2018\nPublic Disclosure: November 2025, DeepSec Vienna 2025\nCVE Assignment: May 2026, following MITRE TL-Root dispute review\n\n\n== Description ==\n\nN-able Mail Assure contains a design-level authorization flaw that allows an authenticated SMTP user from one tenant to \nsubmit outbound email using sender addresses belonging to other unrelated tenants hosted on the same platform.\n\nWhen connecting to the N-able Mail Assure SMTP relay and authenticating with valid credentials, the service accepts \nsender domains that are not bound to, delegated to, or otherwise authorized for the authenticated account. As a result, \nan authenticated user from Tenant A can submit email using a sender address belonging to Tenant B, despite there being \nno administrative relationship, consent, or delegation between the two tenants.\n\nIn the observed tests, the SMTP relay verified that the user had valid credentials, but did not verify that the \nauthenticated identity was authorized to submit mail for the claimed sender domain.\n\nWhere the claimed sender domain authorizes the Mail Assure relay infrastructure in SPF and the message uses an aligned \nRFC5322.From domain, the resulting message can pass SPF and DMARC validation at the receiving MTA, including for \ndomains configured with strict DMARC enforcement.\n\nThe root cause is a missing sender-domain authorization check at SMTP submission time.\n\n\n== Impact ==\n\nAn authenticated Mail Assure user may be able to impersonate other domains hosted on the Mail Assure platform.\n\nIn the observed test case, this produced messages that:\n\n- Passed SPF validation at the receiving MTA\n- Passed DMARC validation\n- Appeared as authenticated mail to the recipient environment\n- Bypassed the protection expected from strict DMARC policies\n\nThis issue may enable phishing, Business Email Compromise (BEC), vendor impersonation, and other social engineering \nattacks against organizations that believe their domains are protected by correctly configured SPF and DMARC policies.\n\nA March 2025 analysis documented in the accompanying technical paper identified approximately 17,000 domains relying on \nthe Mail Assure platform.\n\n\n== Proof of Concept Summary ==\n\nThe issue was validated using legitimate Mail Assure credentials from a tenant controlled by the researchers.\n\nA controlled test showed that an authenticated account belonging to one Mail Assure tenant could submit an outbound \nmessage using a sender address belonging to a different, unaffiliated Mail Assure tenant domain.\n\nObserved result:\n\n- Authentication: valid credentials from Tenant A\n- Claimed sender domain: Tenant B, unaffiliated with Tenant A\n- SMTP result: message accepted for delivery\n- Recipient environment: Microsoft 365\n- Authentication result: SPF PASS and DMARC PASS\n- Target domain policy: strict DMARC enforcement\n\nFull SMTP session transcript, screenshots, and supporting evidence are documented in the technical paper (pages 33-36).\n\nNo credentials, tokens, private user data, or mailbox contents are published in this advisory. No harm was caused to \nany third-party domain or its users.\n\n\n== Disclosure Timeline ==\n\nOctober 2018       Vulnerability discovered during a penetration test and reported to SolarWinds security contacts.\n2018-2024          Issue remained unresolved despite prior notification.\nMarch 2025         Retest performed and issue confirmed as still exploitable.\nNovember 2025      Public disclosure presented at DeepSec Vienna 2025.\nDecember 2025      CVE request submitted to MITRE under Service Request #1964945.\nJanuary 2026       N-able PSIRT contacted during the CVE request process. N-able disputed the vulnerability \nclassification.\nJan-April 2026     CVE dispute process conducted by MITRE TL-Root.\nApril 2026         N-able confirmed the cross-tenant sender behavior in correspondence with MITRE TL-Root.\nMay 2026           MITRE TL-Root determined that the issue meets CVE assignment criteria. CVE-2025-68624 assigned with \nthe DISPUTED tag.\n\n\n== Vendor Response ==\n\nN-able disputes that the reported behavior constitutes a security vulnerability.\n\nN-able\u0027s position is that the behavior is intended functionality of its shared SMTP relay architecture and that the \nservice does not represent that it enforces per-tenant sender-domain binding.\n\nThe CVE record carries the DISPUTED tag to reflect the vendor\u0027s position.\n\n\n== Recommended Mitigation ==\n\nThe SMTP relay should enforce sender-domain authorization at submission time.\n\nRecommended controls include:\n\n- Bind authenticated accounts to the domains they are authorized to send from\n- Reject outbound messages where the authenticated identity is not authorized for the claimed MAIL FROM and \nRFC5322.From domains\n- Require explicit delegation before allowing cross-domain sending\n- Log and alert on attempted unauthorized cross-tenant sender-domain usage\n- Provide tenant administrators with visibility into authorized sender domains and attempted violations\n\n\n== References ==\n\n- Technical paper, DeepSec Vienna 2025, Infinity-Day at Scale: Hijacking Registrars, Defeating 2FA and Spoofing 17,000+ \nDomains:\n  https://github.com/alessandrobertoldi/research/blob/main/infinity-day-at-scale-deepsec2025.pdf\n- Advisory (GitHub Gist):\n  https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92\n- N-able Mail Assure product page:\n  https://www.n-able.com/products/mail-assure\n- CVE record:\n  https://www.cve.org/CVERecord?id=CVE-2025-68624\n\n\n== Credits ==\n\nDiscovered and reported by:\nAlessandro Bertoldi, Bertoldi Cybersecurity\nhttps://bcsec.io/eng.html\nhttps://linkedin.com/in/bertoldicybersecurity\n\nCo-author:\nEnrico Bertoldi, Bertoldi Cybersecurity\nhttps://bcsec.io/eng.html\n\nOriginal 2018 disclosure:\nBertoldi Cybersecurity Team\n\n\n\"Empowering your business with cutting-edge cybersecurity solutions, \nsafeguarding your digital assets and ensuring a seamless, secure experience for your customers.\"\nBertoldiCybersecurity\nAlessandro Bertoldi\n\nOwner\nT. +39 0185 799079\n\nM. +39 348 5130136\nE-Mail alessandro () bertoldicybersecurity com\nwww.bertoldicybersecurity.comhttps://bcsec.io\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T08:33:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/10"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/10"
        },
        {
          "url": "https://bcsec.io"
        },
        {
          "url": "https://bcsec.io/eng.html"
        },
        {
          "url": "https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92"
        },
        {
          "url": "https://github.com/alessandrobertoldi/research/blob/main/infinity-day-at-scale-deepsec2025.pdf"
        },
        {
          "url": "https://linkedin.com/in/bertoldicybersecurity"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68624"
        },
        {
          "url": "https://www.n-able.com/products/mail-assure"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/10"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2025-68624: Cross-Tenant Authentication Bypass by Spoofing in N-able Mail Assure",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-68624",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0512",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/10",
            "automated": true,
            "contentSha256": "7ed8a00852a83602373fa7f4bfda95640e10e3a73b646f032710955300e81e8d",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/10",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-15T19:51:28Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0512"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T08:33:22Z",
    "dateUpdated": "2026-11-02T08:33:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0512"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}