Threats tagged 'ghsa-67h5-cmp2-p9hr'

hMailServer versions 6.2.22-pre2 through 6.3.7 have an authentication issue where account name comparisons by the database differ from the per-name lockout and compromised-account hold checks. This discrepancy allows remote unauthenticated attackers to bypass lockout thresholds by guessing passwords under different account name spellings. Additionally, accounts held for review can be accessed using alternate spellings with the correct password. The issue arises from how various databases handle case, accents, whitespace, and character width in account names, leading to multiple spellings of the same account with separate lockout thresholds.