CVE-2026-107567: CWE-348: Use of Less Trusted Source in Progressive Robot Ltd hMailServer

The vulnerability arises from hMailServer's DKIM signing process, which signs all messages on their first delivery pass as the domain indicated in the From header without verifying that the sender is authorized for that domain. This allows an unauthenticated remote attacker to send mail that is signed with the DKIM key of any hosted domain, causing the mail to pass DKIM and DMARC checks at recipients. The issue affects versions 6.0.0 through 6.3.6. Exploitation requires DKIM signing enabled for the domain and a forwarding or aliasing mechanism that sends mail outside the server. Additionally, messages submitted via authenticated SMTP can be signed as any hosted domain regardless of the submitting account's domain, potentially bypassing sender checks. This flaw is classified under CWE-348 (Use of Less Trusted Source).

An attacker can forge emails that appear to be legitimately signed by any domain hosted on the vulnerable hMailServer, allowing these emails to pass DKIM and DMARC validation at receiving mail servers. This undermines domain-based email authentication, potentially facilitating phishing, spoofing, or other email-based attacks. The vulnerability does not impact confidentiality or availability but has a high impact on email integrity and trust.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling DKIM signing for hosted domains or avoid forwarding mechanisms that send mail externally if DKIM signing is enabled. Additionally, review SMTP authentication settings such as SmtpAuthenticatedSenderCheck to limit cross-domain signing risks.