CVE-2025-68624 describes an authentication bypass by spoofing vulnerability (CWE-290) in N-able Mail Assure's SMTP service. Authenticated SMTP users can specify arbitrary MAIL FROM addresses belonging to other tenants because the server does not enforce domain-to-account binding post-authentication. This allows attackers to impersonate other tenant domains, producing emails that pass SPF and DMARC validation. N-able considers this behavior intentional within its shared SMTP relay architecture and does not provide per-tenant sender-domain enforcement.

An attacker with valid SMTP credentials from any tenant can send emails that appear to originate from other tenants' domains. This can lead to domain impersonation and potentially undermine trust in email authenticity, as spoofed messages can pass SPF and DMARC checks. However, there is no direct confidentiality or availability impact reported.

No official patch or fix is available. N-able states this behavior is intended functionality of its shared SMTP relay architecture and does not enforce per-tenant sender-domain binding. Users should be aware of this design choice and consider compensating controls outside the service if domain spoofing risk is unacceptable. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.