CVE-2026-101280: Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarcpolicyquerydmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
OpenDMARC versions up to and including 1.4.2 are affected. The vulnerable functionality is the Multi-Record Set Handler in opendmarc_policy_query_dmarc.
What does an attacker need to exploit this issue?
The attack can be executed remotely and does not require privileges or user interaction. Exploitation involves manipulating multi-record DMARC sets to bypass authentication through spoofing.
Is exploitation publicly available?
Yes. A public exploit is reported as available, increasing the likelihood of attempted exploitation.
Is a vendor fix available?
The provided information does not identify a fixed version or vendor response. The vendor was contacted but reportedly did not respond.