CVE-2026-114471: Insertion of Sensitive Information into Log File in hMailServer
Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH PLAIN command only when it was sent after EHLO in one exact form, and wrote the rest of the SASL exchange as the client sent it: a PLAIN password sent before EHLO or with extra spacing, the OAuth 2.0 bearer token of AUTH XOAUTH2 and AUTH OAUTHBEARER (from 6.2.0), the SCRAM-SHA-256 client proof (from 6.2.0), which with the logged salt and iteration count allows offline password guessing, and the GSSAPI authenticator (from 6.3.2). SMTP logging is off by default; on Windows before 6.3.6 the log folder was readable by every local user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progressive Robot hMailServerto a version that resolves this vulnerability.Fixed in 6.3.7 - Configuration
Turn SMTP logging off where it is not needed.
hMailServer SMTP logging SMTP logging = off - Compensating control
When SMTP logging is enabled, restrict the log folder so it is readable only by administrators.
- Operational
Before sharing logs, remove or redact AUTH exchanges. If logs may have been read by others, revoke the OAuth 2.0 grants and change the passwords of accounts that signed in; delete or redact already-written logs because upgrading does not remove credentials from them.
Event History
Frequently Asked Questions
Which deployments are exposed to credential leakage?
Only deployments with SMTP logging enabled are exposed; SMTP logging is off by default. On Windows versions before 6.3.6, every local user could read the log folder, increasing local exposure.
What must an attacker have to obtain credentials or authentication material?
An attacker needs local access to read the server logs, or a copy of those logs. The issue does not describe remote log access as a prerequisite or capability.
Which authentication exchanges can be recorded in the logs?
Logs may contain AUTH PLAIN passwords sent before EHLO or with extra spacing, OAuth 2.0 bearer tokens from AUTH XOAUTH2 and AUTH OAUTHBEARER starting in 6.2.0, SCRAM-SHA-256 client proofs starting in 6.2.0, and GSSAPI authenticators starting in 6.3.2. Logged SCRAM data includes the salt and iteration count, enabling offline password guessing.
What can be done if updating is not immediately possible?
Disable SMTP logging to prevent further authentication exchanges from being written to logs. Restrict access to existing log files, since anyone given a copy can recover the recorded credential material.
How can administrators determine whether prior logs may contain exposed data?
Review SMTP logs generated while logging was enabled for AUTH PLAIN, AUTH XOAUTH2, AUTH OAUTHBEARER, SCRAM-SHA-256, or GSSAPI exchanges. Pay particular attention to PLAIN authentication sent before EHLO or with extra spacing, because only one exact post-EHLO form was redacted.