CVE-2026-34833CWE-312

Bulwark Webmail: Information Exposure: password returned in /api/auth/session

High · published April 2, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
18.0
In the wild
Unconfirmed
What it is

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00269 · 18.0th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-04-02T19:11Z
EPSS history
Timeline
  • 02 APR 19:11Z
    Bulwark Webmail: Information Exposure: password returned in /api/auth/session
    cvelistv5