CVE-2026-34833 Bulwark Webmail: Information Exposure: password returned in /api/auth/session
Attackers can retrieve plaintext passwords from the session API endpoint, leading to credential theft and potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34833?
CVE-2026-34833 is a high-severity vulnerability in bulwarkmail webmail, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.
Weakness: CWE-312
Which versions are affected by CVE-2026-34833?
It affects 1 product.
Products include Bulwarkmail Webmail.
How do I fix CVE-2026-34833?
No fix has been published for CVE-2026-34833 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-34833 being exploited?
There is no known exploitation of CVE-2026-34833 in the wild and no public exploit code.
Other vulnerabilities in bulwarkmail webmail
- CVE-2026-35389 Bulwark Webmail S/MIME signature verification accepted self-signed certificates
- CVE-2026-35391 Security feature bypass in webmail
- CVE-2026-34834 Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
- CVE-2026-35390 Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks
Sources
Also known as GHSA-47pm-883h-885r.