Incorrect Authorization in the Sender Rewriting Scheme of Progressive Robot hMailServer allows a remote attacker to bypass authentication and relay mail to any address encoded in an SRS address. With SRS enabled, the server treats every message to a valid SRS address as a local delivery, ignoring relay rules and SMTP authentication. Consequently, the attacker can send mail to external domains without authenticating, enabling spam or phishing campaigns. This flaw is rated moderate severity (CVSS 5) but can be abused if the attacker obtains a valid SRS address for up to 21 days.

Progressive Robot Ltd’s hMailServer product, versions 6.2.1 through 6.3.6, is affected. These versions are still in use in some installations.

The CVSS score of 5 reflects a moderate impact and the lack of an EPSS score means the exploitation probability is not quantified. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Attackers need to have a valid SRS address, which can be gained by being a recipient of a forwarded message, and then can exploit the server for 21 days to send emails to arbitrary external addresses. The attack path is simple in that the server automatically accepts the relay, so once a suitable SRS address is known, the exploit requires no other credentials. This creates a significant risk for abuse as the server can become a source of spam.