CVE-2026-34834CWE-287

Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation

High · published April 2, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00424 · 35.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-04-02T19:11Z
EPSS history
Timeline
  • 02 APR 19:11Z
    Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
    cvelistv5