IT SBIT Services
Schneeberger
DEEN
CVE tracker

Progressive Robot hMailServer: Auto-ban bypass with non-BMP user names

CVE-2026-126616Medium 5.3

← All vulnerabilities

Summary

hMailServer 6.2.0 through 6.3.3 with a MySQL or MariaDB database can be kept from auto-banning an address after repeated failed logons. A SASL PLAIN logon whose user name contains a character outside the Basic Multilingual Plane makes the ban's IP range save fail, so the address is not blocked and gets a fresh set of attempts. A remote unauthenticated attacker can therefore guess passwords from one address without being banned. Default installations are not affected by the database condition, but POP3 AUTH PLAIN on Windows is reachable without any setting, and IMAP, SMTP, ManageSieve and CardDAV are reachable where they are enabled.

Affected

  • hMailServer 6.2.0 through 6.3.3
  • Only with a MySQL or MariaDB database
  • Linux: from 6.3.0, SMTP AUTH PLAIN where plain-text authentication is allowed
  • Windows: POP3 AUTH PLAIN on a default installation; IMAP AUTHENTICATE PLAIN where IMAP SASL is enabled; SMTP AUTH PLAIN where plain-text authentication is allowed; ManageSieve and CardDAV where enabled

Fixed in

  • Upgrade to hMailServer 6.3.4 or later, and run the database upgrade (schema 6102) that converts the MySQL and MariaDB tables to utf8mb4
  • The vendor states that 6.3.8 also fixes a separate auto-ban bypass (GitLab issue #104)
  • Unknown whether a newer release is current; check the vendor site

Workaround

  • Set MaxInvalidLogonAttempts to 1 (vendor's interim measure; a guess at an existing account is then banned under that name)
  • Convert the IP range table to utf8mb4 as the 6.3.4 upgrade step does (ALTER TABLE hm_securityranges ENGINE=InnoDB, ROW_FORMAT=DYNAMIC, CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci)
  • The per-name lockout (AccountLockoutThreshold) is not a usable mitigation because of a separate defect (#104)

Exploitation

  • Not known to be exploited (per OffSeq)
  • VulDB states that technical details are unknown and no exploit is available
  • No public proof of concept or researcher write-up found as of 11 November 2026
  • The vendor's issue describes the mechanism in detail, so a proof of concept may appear soon
  • No authentication is required

Our recommendation

  • Check whether hMailServer 6.2.0 to 6.3.3 runs with MySQL or MariaDB and which protocols are enabled
  • Plan a backup and a maintenance window, then upgrade to 6.3.4 or later and complete the database upgrade; verify checksums and signatures of the download
  • Until patched, set MaxInvalidLogonAttempts to 1 and monitor the error log for failed auto-ban saves (HM5032, HM6099)
  • Enforce strong passwords and use external brute-force protection, since the built-in auto-ban cannot be relied on
  • Restrict access to POP3, IMAP, SMTP, ManageSieve and CardDAV where possible

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:56.

Original description (NVD)

The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker to go on guessing account passwords from a single address without being banned. The server makes its MySQL tables in MySQL's utf8 character set, which holds no character outside the Basic Multilingual Plane, sends its statements as UTF-8 over a utf8mb4 connection and leaves the database's default strict mode in place. From 6.2.0 it decodes the user name of a SASL PLAIN logon as UTF-8, so the name can hold such a character. When the failed logons counted from one address reach MaxInvalidLogonAttempts (3 by default), the server clears that address's count, saves an IP range named "Auto-ban: " followed by the user name of the logon that reached the limit, and drops the connection. If such a character is in the part of the user name that the range's name keeps (the name is cut to 100 characters), the database refuses the range: no range is saved, the address is not refused, and, its count having already been cleared, it is given the next full set of attempts. An attacker can in this way spend all but the last attempt of each set on password guesses, and make the last under such a name. On Windows, POP3 AUTH PLAIN reaches it on a server as installed, and IMAP AUTHENTICATE PLAIN where IMAP SASL authentication is turned on (off by default); on Windows and on Linux (from 6.3.0), SMTP AUTH PLAIN reaches it where plain-text authentication is allowed (off by default), and ManageSieve and CardDAV where they are turned on (off by default). Each failed save is reported in the server's error log. A database whose strict mode has been turned off stores the character as a question mark and makes the first such ban, but refuses every later ban named after the same user name, or after one holding other such characters in their place, as a duplicate while the first stands, since the server cannot look up a name holding such a character there.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed