Insertion of Sensitive Information into Log File in hMailServer
Impact
hMailServer 6.0.0 through 6.3.6 is affected by insertion of sensitive information into log files, allowing local users or those with log access to obtain credentials. SMTP logging is off by default. A local user can read the server's log.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Upgrade to hMailServer 6.3.7, which masks every line of a SASL exchange and every AUTH initial response in the SMTP log, but the user name of AUTH LOGIN and the authentication identity of AUTH PLAIN, as before. Until then, turn SMTP logging off where it is not needed or keep the logs readable by administrators only, remove the AUTH exchanges from a log before sharing it, and where a log may have been read by others revoke the OAuth 2.0 grants and change the passwords of the accounts that signed in (after upgrading as well: an upgrade does not take credentials out of logs already written, so delete or redact those logs).
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Progressive Robot Ltd · GitLab
hMailServer
1 range
Progressive Robot Ltd · GitLab
hMailServer
Compare with this publisher’s ranges. This does not inspect your installation.
affected
6.0.0 → through 6.3.6
semver versions
Other versions: unaffected
Original source description
Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH PLAIN command only when it was sent after EHLO in one exact form, and wrote the rest of the SASL exchange as the client sent it: a PLAIN password sent before EHLO or with extra spacing, the OAuth 2.0 bearer token of AUTH XOAUTH2 and AUTH OAUTHBEARER (from 6.2.0), the SCRAM-SHA-256 client proof (from 6.2.0), which with the logged salt and iteration count allows offline password guessing, and the GSSAPI authenticator (from 6.3.2). SMTP logging is off by default; on Windows before 6.3.6 the log folder was readable by every local user.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-114471View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.