Overly Restrictive Account Lockout Mechanism in hMailServer
Summary
| CVE | CVE-2026-126626 |
|---|---|
| State | PUBLISHED |
| Assigner | GitLab |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-11 09:17:14 UTC |
| Updated | 2026-11-11 09:17:14 UTC |
| Description | The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 counts every failed CardDAV, CalDAV or Autodiscover sign-in from a proxy it trusts - one on the same machine, or one named in WebServicesTrustedProxies, whose X-Forwarded-Proto it believes - against the proxy's own address, which allows a remote unauthenticated attacker who can reach the proxy to have that address banned from the server's mail listeners. The listener, off by default (WebServicesHttpPort and WebServicesHttpsPort 0), signs an account in with HTTP Basic over HTTPS for CardDAV from 6.3.3 and for CalDAV and Outlook Autodiscover from 6.3.4. Behind a TLS-terminating proxy, which the server trusts when it is on the same machine or named in WebServicesTrustedProxies, the listener takes the client's HTTPS from the proxy's X-Forwarded-Proto header, but it does not believe X-Forwarded-For and sees the proxy's address for every client. Each failed sign-in counted towards the auto-ban against that address, so that failed sign-ins through the proxy from anybody, under any user name, reaching MaxInvalidLogonAttempts (3 within 30 minutes by default) wrote an IP range that refused the proxy's address at the SMTP, POP3, IMAP and ManageSieve listeners for AutoBanMinutes (60 by default), and could write it again each time it lapsed. For a proxy on the same machine that address is the loopback address, so that a webmail on that machine, local scripts that submit mail and the other local clients of the mail listeners were shut out; for a proxy at another address that also carries mail, every mail client behind it was. Such a proxy forwarding to the listener's HTTPS port, re-encrypting, was counted against in the same way, and listing it in WebServicesTrustedProxies did not spare it. The auto-ban is on by default and AutoBanNeverBan, which spares an address, is empty by default; the listener itself went on serving the proxy. |
Risk And Classification
Primary CVSS: v3.1 5.3 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Problem Types: CWE-645 | CWE-645 CWE-645: Overly Restrictive Account Lockout Mechanism
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| 3.1 | CNA | CVSS | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Progressive Robot Ltd | HMailServer | affected 6.3.3 6.3.7 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| gitlab.com/hmailserver/hmailserver/-/work_items/106 | [email protected] | gitlab.com | |
| gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8 | [email protected] | gitlab.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Found by the hMailServer project (Progressive Robot Ltd) (en)
Additional Advisory Data
Solutions
CNA: Upgrade to hMailServer 6.3.8, in which a failed sign-in at the web services listener from loopback or from an address in WebServicesTrustedProxies is counted against the user name alone, towards the per-name lockout (AccountLockoutThreshold in hMailServer.ini, 0, off, by default), and never towards a ban of the address, as for an address in AutoBanNeverBan; a failure from any other address counts as before. A proxy at another address that is not listed, forwarding to the HTTPS port, is not taken for a proxy and is charged as before, as a load balancer is at the mail listeners, until its address is in WebServicesTrustedProxies; from 6.3.8 a ban its clients earn also closes the web services listener to it. Through a proxy the per-name lockout is then the limit on the guesses at one account, so turn it on there. Until then, put the proxy's address in AutoBanNeverBan (127.0.0.1 and ::1 for a proxy on the same machine), which keeps the auto-ban from counting that address's failed logons on any protocol; turning the auto-ban on failed logons off, or setting MaxInvalidLogonAttempts or AutoBanMinutes to 0, also avoids it, for every address. From 6.3.6 the never-ban list by reverse name spares a proxy at another address whose forward-confirmed reverse name it covers, lifting the ban once the name is confirmed; it cannot name loopback.