CVE-2026-111367 Details
Description
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.
A vulnerability exists in BillionMail versions through 4.9, where a hard-coded cryptographic key allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JSON Web Tokens (JWTs). The vulnerability arises because the signing key can be computed from default configuration constants that are publicly accessible. Attackers can exploit this by sending forged tokens to the unsubscribe or subscribe confirmation endpoints, manipulating subscription statuses without authorization.
Update to a version of BillionMail that does not use hard-coded cryptographic keys for JWT signing. If the vulnerability has been patched in a later release, consult the release notes or vulnerability advisory for guidance on how to upgrade.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1394 | Use of Default Cryptographic Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BillionMail | <= 4.9 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |