The vulnerability in OpenDMARC up to version 1.4.2 involves the opendmarc_policy_query_dmarc function within the Multi-Record Set Handler component. This flaw allows an attacker to bypass authentication by spoofing, potentially enabling unauthorized access or manipulation of DMARC policy queries. The attack can be executed remotely without any privileges or user interaction. The vendor was notified but has not issued any response or fix. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

Successful exploitation results in authentication bypass via spoofing, which could undermine the integrity of DMARC policy enforcement. This may allow attackers to impersonate trusted domains or bypass email authentication checks, potentially facilitating phishing or spoofing attacks. There is no indication of active exploitation in the wild at this time.

No official patch or vendor advisory is available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should monitor for updates from the Trusted Domain Project and consider additional email authentication controls or compensating controls to mitigate spoofing risks.