CVE-2026-121452 Details
Description
bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.
A vulnerability exists in bbs-go versions through 4.4.6, where improper validation of TLS certificates in the SMTP email service allows network-positioned attackers to intercept and manipulate email traffic. The issue arises because the sendEmail() function disables certificate verification, enabling attackers to present fraudulent certificates that could be accepted as valid. This exploitation could lead to the interception of SMTP PLAIN authentication credentials, allowing attackers to access and modify outgoing password-reset and verification emails.
Users can update to bbs-go version 4.4.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mlogclub/bbs-go | [email protected] | Vendor |
| https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/email_service.go#L86-L113 | [email protected] | Source CodeVendor |
| https://github.com/mlogclub/bbs-go/commit/1a06e35fa6314ee2d3ada70685a7afa740baf6f5 | [email protected] | Source CodeVendor |
| https://github.com/mlogclub/bbs-go/issues/310 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-improper-tls-certificate-validation-in-smtp-email-service | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mlogclub bbs-go | <= 4.4.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |