CVE-2026-107585 Details
Description
Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in challenge are reached without authentication and stored pending state in bounded tables that dropped their oldest entry when full, whoever had started it. An attacker who starts sign-ins a few times a second (about a hundred a second for passkeys) pushes every other user's pending sign-in out of the table before that user's browser returns, denying single sign-on and passkey sign-in for as long as the requests continue.
A vulnerability exists in Progressive Robot hMailServer versions 6.3.4 and 6.3.5, where uncontrolled eviction in the REST API pending sign-in tables allows remote unauthenticated attackers to disrupt other users' OpenID Connect, SAML, and passkey sign-ins. The affected routes can be accessed without authentication, and they store pending sign-in states in limited tables that discard the oldest entry when full. This flaw enables attackers to flood the sign-in tables, causing legitimate users' sign-in requests to fail.
Users can upgrade to hMailServer version 6.3.6, which addresses this vulnerability by eliminating the pending sign-in tables and implementing a cookie-based system for managing sign-in states. Instructions for upgrading are available in the release notes for version 6.3.6.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6 | [email protected] | Release NotesVendor |
| https://gitlab.com/hmailserver/hmailserver/-/work_items/63 | [email protected] | ExploitIssue TrackingRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Progressive Robot hMailServer | 6.3.4 (semver) 6.3.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |