CVE-2026-111367: BillionMail through 4.9 Forgeable JWTs via Default Signing Key
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribenew, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
BillionMail versions through 4.9 are affected. The vulnerable JWT signing key can be computed from configuration constants shipped with the product.
What does an attacker need to exploit this?
An attacker does not need authentication or user interaction. They need to generate forged unsubscribe or subscribe-confirm JWTs and submit them to the affected API endpoints.
What actions can forged tokens perform?
Forged tokens can be used with /api/unsubscribe or /api/unsubscribe_new to deactivate any contact. They can also be submitted to /api/subscribe/confirm to force subscriptions into a confirmed state.