CVE-2026-114471: CWE-532: Insertion of Sensitive Information into Log File in Progressive Robot Ltd hMailServer

This vulnerability (CVE-2026-114471) affects hMailServer SMTP server versions 6.0.0 through 6.3.6. When SMTP logging is enabled, the server attempts to hide credentials only for the AUTH PLAIN command sent after EHLO in one exact form. However, other forms of authentication data are logged in cleartext or partially exposed, including PLAIN passwords sent before EHLO or with extra spacing, OAuth 2.0 bearer tokens used in AUTH XOAUTH2 and AUTH OAUTHBEARER (from version 6.2.0), SCRAM-SHA-256 client proofs (from 6.2.0), and GSSAPI authenticators (from 6.3.2). The SCRAM-SHA-256 client proof combined with logged salt and iteration count allows offline password guessing. SMTP logging is disabled by default, but on Windows systems prior to 6.3.6, the log folder was readable by all local users, allowing local attackers to obtain sensitive credentials from logs.

Local users who can read the SMTP server's log files, or anyone with access to a copy of these logs, can obtain sensitive authentication credentials. This includes plaintext passwords, OAuth tokens, and data enabling offline password guessing. This exposure can lead to credential compromise and unauthorized access to mail services. The vulnerability does not affect confidentiality of other data or availability, and requires local access or access to log files.

SMTP logging is off by default, which reduces exposure risk. Users should ensure SMTP logging remains disabled unless necessary. On Windows systems before version 6.3.6, restrict permissions on the log folder to prevent unauthorized local access. Upgrade hMailServer to a version later than 6.3.6 once available, as this version addresses log folder permissions. Patch status is not explicitly confirmed; check vendor advisories for official fixes or updates.