Bulwark Webmail inadvertently returned the user’s plaintext password in the JSON payload from the GET /api/auth/session endpoint. This flaw, a Classic CWE-312 weakness, allows anyone who can observe the response—through browser logs, local caches, or network proxies—to capture valid login credentials without additional attack steps.

Any Bulwark Webmail deployment running a version before 1.4.10 is affected regardless of its hosting environment or network configuration. The vulnerability is linked to the authentication data returned by the web interface and therefore applies to all users of the affected service.

The vulnerability scores a CVSS base of 8.7, indicating a high impact on confidentiality. With an EPSS below 1% and no record in the CISA KEV catalog, exploitation opportunities are currently limited but still possible. An attacker only needs to send a standard HTTP request to the vulnerable API or intercept the traffic; no elevated privileges or code execution are required. Once the plaintext password is retrieved, the attacker can log in to the mail system, potentially access other services tied to the same account, and compromise the user’s overall security posture.