hMailServer: Overly restrictive account lockout blocks mail listeners
Summary
The web services listener of hMailServer 6.3.3 to 6.3.7 (CardDAV, CalDAV and Outlook Autodiscover) counts failed sign-ins arriving through a trusted or local TLS-terminating proxy against the proxy's own IP address. A remote, unauthenticated attacker who can reach that proxy can trigger an auto-ban of the proxy address, which blocks it from the SMTP, POP3, IMAP and ManageSieve listeners for 60 minutes by default and can renew the ban. This affects local webmail and scripts on the same host, and all mail clients behind a proxy at another address; the web services listener itself keeps serving the proxy. The issue only applies if the web services listener is enabled, which is off by default.
Affected
- hMailServer 6.3.3 to 6.3.7
- CardDAV affected from 6.3.3, CalDAV and Autodiscover from 6.3.4
- Only with the web services listener enabled (WebServicesHttpPort or WebServicesHttpsPort not 0) behind a TLS-terminating proxy
Fixed in
- Fixed in hMailServer 6.3.8
- Vendor states that 6.3.4 to 6.3.7 update to 6.3.8
Workaround
- Add the proxy address to AutoBanNeverBan (127.0.0.1 and ::1 for a proxy on the same machine); this removes brute-force protection for that address
- Compensate with a per-name lockout (AccountLockoutThreshold) and rate limiting at the reverse proxy
- If CalDAV, CardDAV and Autodiscover are not used, set WebServicesHttpPort and WebServicesHttpsPort to 0
Exploitation
- No known exploitation in the wild
- No public proof of concept found in the research; this does not rule one out
Our recommendation
- Upgrade to hMailServer 6.3.8 wherever the web services listener is enabled
- Disable the web services listener if CalDAV, CardDAV and Autodiscover are not used
- Until patched, apply the AutoBanNeverBan workaround with a per-name lockout and proxy-side rate limiting
- Check the auto-ban log for banned proxy addresses and monitor failed sign-ins at the proxy
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- hMailServer 6.3.8 release page gitlab.com
- GitLab issue #106: Web services listener auto-ban of trusted proxy gitlab.com
- CVE Record CVE-2026-126626 www.cve.org
- VulDB CVE-2026-126626 vuldb.com
- OffSeq radar: web services listener counts failed CardDAV sign-ins radar.offseq.com
- Progressive Robot hMailServer downloads www.progressiverobot.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:54.
Original description (NVD)
The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 counts every failed CardDAV, CalDAV or Autodiscover sign-in from a proxy it trusts - one on the same machine, or one named in WebServicesTrustedProxies, whose X-Forwarded-Proto it believes - against the proxy's own address, which allows a remote unauthenticated attacker who can reach the proxy to have that address banned from the server's mail listeners. The listener, off by default (WebServicesHttpPort and WebServicesHttpsPort 0), signs an account in with HTTP Basic over HTTPS for CardDAV from 6.3.3 and for CalDAV and Outlook Autodiscover from 6.3.4. Behind a TLS-terminating proxy, which the server trusts when it is on the same machine or named in WebServicesTrustedProxies, the listener takes the client's HTTPS from the proxy's X-Forwarded-Proto header, but it does not believe X-Forwarded-For and sees the proxy's address for every client. Each failed sign-in counted towards the auto-ban against that address, so that failed sign-ins through the proxy from anybody, under any user name, reaching MaxInvalidLogonAttempts (3 within 30 minutes by default) wrote an IP range that refused the proxy's address at the SMTP, POP3, IMAP and ManageSieve listeners for AutoBanMinutes (60 by default), and could write it again each time it lapsed. For a proxy on the same machine that address is the loopback address, so that a webmail on that machine, local scripts that submit mail and the other local clients of the mail listeners were shut out; for a proxy at another address that also carries mail, every mail client behind it was. Such a proxy forwarding to the listener's HTTPS port, re-encrypting, was counted against in the same way, and listing it in WebServicesTrustedProxies did not spare it. The auto-ban is on by default and AutoBanNeverBan, which spares an address, is empty by default; the listener itself went on serving the proxy.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.