A local user who can read hMailServer log files, or anyone who obtains a copy of those logs, can recover user credentials. This is a CWE‑532 weakness, wherein sensitive data is exposed through log file entries. The vulnerability arises from the SMTP logging feature, which in versions 6.0.0 through 6.3.6 writes authentication exchanges—including PLAIN passwords, OAuth 2.0 bearer tokens, SCRAM client proofs, and GSSAPI identifiers—exactly as received, except for a single specific form of AUTH PLAIN. Because the log entry is stored in plain text, an attacker can directly capture user names and password mechanisms compromising confidentiality.

This issue affects Progressive Robot Ltd’s hMailServer product versions 6.0.0 through 6.3.6. The default Windows log folder is world‑readable on pre‑6.3.6 deployments, and SMTP logging is enabled only when explicitly configured.

The CVSS score of 4.7 indicates a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local file‑system access or possession of a previously written log; thus the likely attack vector is a local or post‑exposure compromise rather than a remote exploit. An attacker who can read these logs can obtain credentials for all accounts connected to the server during the logging period.