CVE-2026-114471

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114471
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114471.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114471
Published
2026-10-21T15:11:50Z
Modified
2026-10-22T02:48:51Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Insertion of Sensitive Information into Log File in hMailServer
Details

Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH PLAIN command only when it was sent after EHLO in one exact form, and wrote the rest of the SASL exchange as the client sent it: a PLAIN password sent before EHLO or with extra spacing, the OAuth 2.0 bearer token of AUTH XOAUTH2 and AUTH OAUTHBEARER (from 6.2.0), the SCRAM-SHA-256 client proof (from 6.2.0), which with the logged salt and iteration count allows offline password guessing, and the GSSAPI authenticator (from 6.3.2). SMTP logging is off by default; on Windows before 6.3.6 the log folder was readable by every local user.

Database specific 
{
    "cna_assigner":  "GitLab",
    "cwe_ids":  [
        "CWE-532"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114471.json"
}
References

Affected packages

Git / gitlab.com/hmailserver/hmailserver

Affected ranges

Type
GIT
Repo
https://gitlab.com/hmailserver/hmailserver
Events
Introduced
e4b7163189ac6ce365bb954cf3e264e2e3105a18
Last Affected
e3c448aa66fc310b74d076884d54fae951296915
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "6.0.0"
                },
                {
                    "last_affected":  "6.3.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

Other
build-inputs-1
v6.*
v6.0.0
v6.0.0-B3
v6.0.0-B4
v6.1.0
v6.2.0
v6.2.1
v6.2.10
v6.2.11
v6.2.12
v6.2.13
v6.2.14
v6.2.15
v6.2.16
v6.2.17
v6.2.18
v6.2.19
v6.2.2
v6.2.20
v6.2.21
v6.2.22-pre1
v6.2.22-pre2
v6.2.22-pre3
v6.2.22-pre4
v6.2.22-pre5
v6.2.22-pre6
v6.2.23-alpha1
v6.2.23-alpha2
v6.2.24
v6.2.25
v6.2.26
v6.2.27
v6.2.28
v6.2.3
v6.2.4
v6.2.5
v6.2.6
v6.2.7
v6.2.8
v6.2.9
v6.3.0
v6.3.1
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.3.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114471.json"