What’s Vulnerable › Vulnerabilities

CVE-2026-34834: Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-02 · updated 2026-07-24
• Weakness: CWE-287

Description

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.

Affected products

• bulwarkmail webmail: before 1.4.10 — fixed in 1.4.10

How to fix

Upgrade to a fixed version: bulwarkmail webmail 1.4.10. Check the vendor advisory for mitigations.

References

• https://github.com/bulwarkmail/webmail/releases/tag/1.4.10
• https://github.com/bulwarkmail/webmail/security/advisories/GHSA-4356-876g-rfmh

Get alerted when CVE-2026-34834 or the next vulnerability affects your stack