A flaw in the Trusted Domain Project OpenDMARC library allows manipulation of the SPF macro handler function opendmarc_sp2_find_mailfrom_domain, causing the authentication process to be bypassed or weakened. This improper authentication can allow an attacker to forge the originating address or otherwise circumvent SPF checks, potentially granting unauthorized access to email handling functions or masquerading as legitimate senders. The weakness is rooted in authentication failure (CWE-287).

The affected product is Trusted Domain Project OpenDMARC, versions up to 1.4.2. Any deployment of OpenDMARC 1.4.2 or earlier that relies on the SPF macro handler is vulnerable. These include systems that perform SPF verification for incoming mail and postmaster macro processing.

The CVSS score of 6.9 indicates a moderate severity, and while the EPSS score is not available, the vulnerability has an publicly released exploit, meaning it could be used by attackers. The attack vector is remote, and the vulnerability is listed as not in CISA KEV, yet the published exploit raises concern for immediate attention. Attacks would likely involve sending crafted email that tricks the macro handler into accepting a forged domain, enabling spoofing or unauthorized email delivery.