Description
Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain's key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain's DMARC policy: an account's forward, a mail rule's forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain's key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain's mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain its From header named, a header authenticated SMTP does not hold to the submitting account, so that an account of one hosted domain could have mail written in the name of another hosted domain signed with that domain's key; this mattered where the server holds signed-in senders to their own envelope addresses (SmtpAuthenticatedSenderCheck, off by default), as the signature was then the remaining way for such mail to pass the other domain's DMARC policy.
Published: 2026-10-19
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Forged Email Signatures
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises because hMailServer signs every inbound message with the DKIM key of a hosted domain without verifying that the sender was authenticated for that domain. A remote attacker who can deliver mail to the server can craft a message whose From header points to an address on a domain the server hosts, and the server will sign it with that domain’s DKIM key. The resulting message passes both DKIM and DMARC checks at external receivers, effectively forging the domain’s identity. This is a misuse of a trusted source for signing, matching CWE‑348.

Affected Systems

The affected product is Progressive Robot Ltd’s hMailServer, versions 6.0.0 through 6.3.6. All installations that have DKIM signing enabled for any hosted domain are vulnerable, regardless of whether authentication checks are configured. The fix is available in release 6.3.7.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. Exploitation requires only the ability to send unauthenticated mail to the server, a channel that is typically open. An attacker can then obtain forged DKIM signatures that bypass DMARC at external domains. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of an in‑house mitigation makes the risk substantial. Until the patch is applied, administrators should enforce DMARC quarantine or reject policies or disable DKIM signing for the affected domains to block forged mail from being forwarded.

Generated by OpenCVE AI on October 19, 2026 at 16:23 UTC.

Remediation

Vendor Solution

Upgrade to hMailServer 6.3.7. It records on each message, and on every copy of it, whether the message came from outside: an SMTP session that did not authenticate and was not a submission the server's IP ranges allow without authentication, a download from an external account, or an imported file. It signs a message as its From domain only when an authenticated user submitted it (as another domain the server hosts only when the account may send as the address its From names), the server made it, or an IP range let it in as one of the server's own domains, so mail from outside and its forwards keep only the signatures they arrived with, and a signed-in account's message from an address at another hosted domain that the account may not send as is sent unsigned as that domain. Until then, do one of the following: publish a DMARC policy of quarantine or reject for each hosted domain the server signs for and set the server's DMARC failure score (DMARCFailureScore) at or above the spam delete threshold (SpamDeleteThreshold), so that such a message is refused on arrival; refuse it in an OnAcceptMessage event script when the client has not authenticated and the From header names a domain the server signs for; remove the forwards, rule forwards, Sieve redirects, alias and list members and mirror addresses that carry mail to outside addresses; or disable DKIM signing for the hosted domains, which alone of these also covers a signed-in account's submission. Rotate the DKIM key of any domain whose key may have signed forged mail.

OpenCVE Recommended Actions

  • Upgrade hMailServer to version 6.3.7 to correct the DKIM signing logic.
  • If an upgrade cannot be performed immediately, publish a DMARC policy of quarantine or reject for each hosted domain and set the DMARCFailureScore to the spam‑delete threshold, so that forwarded messages with forged signatures are refused upon arrival.
  • As a temporary measure, disable DKIM signing for the vulnerable hosted domains or rotate their DKIM keys until the patch is applied.

Generated by OpenCVE AI on October 19, 2026 at 16:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With DKIM signing enabled for a hosted domain, the server signed every message on its first delivery pass as the domain named in its From header, before local delivery, whatever the message's origin and without checking that its sender had authenticated. A sender anywhere could therefore send the server, as ordinary inbound mail, a message whose From is any address at such a domain, and the server signed it with that domain's key. Every copy the server then sent on to an address outside carried a valid signature aligned with the forged From, whatever the domain's DMARC policy: an account's forward, a mail rule's forward or copy, a Sieve redirect, an alias or distribution list with an outside member, the mirror copy, a managed-list or journal copy, or a message released from quarantine. A signed copy can also be re-sent to other recipients while the domain's key is unchanged. Exploitation needs DKIM signing to be enabled for the hosted domain (it is off until configured) and, for the forgery to leave the server, a forward, alias, list or rule that carries the domain's mail to an outside address. The signer likewise signed a message submitted over authenticated SMTP as whatever hosted domain its From header named, a header authenticated SMTP does not hold to the submitting account, so that an account of one hosted domain could have mail written in the name of another hosted domain signed with that domain's key; this mattered where the server holds signed-in senders to their own envelope addresses (SmtpAuthenticatedSenderCheck, off by default), as the signature was then the remaining way for such mail to pass the other domain's DMARC policy.
Title Use of Less Trusted Source in hMailServer
Weaknesses CWE-348
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-10-19T15:34:17.494Z

Reserved: 2026-10-08T10:51:00.638Z

Link: CVE-2026-107567

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T16:17:01.587

Modified: 2026-10-19T16:17:01.587

Link: CVE-2026-107567

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:30:13Z

Weaknesses
  • CWE-348

    Use of Less Trusted Source