CVE-2026-34834 Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
Unauthenticated attackers can bypass identity verification to access and modify user settings in Bulwark Webmail.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34834?
CVE-2026-34834 is a high-severity authentication bypass vulnerability in bulwarkmail webmail, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.
Weakness: CWE-287
Which versions are affected by CVE-2026-34834?
It affects 1 product.
Products include Bulwarkmail Webmail.
How do I fix CVE-2026-34834?
No fix has been published for CVE-2026-34834 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-34834 being exploited?
There is no known exploitation of CVE-2026-34834 in the wild and no public exploit code.
Other vulnerabilities in bulwarkmail webmail
- CVE-2026-35389 Bulwark Webmail S/MIME signature verification accepted self-signed certificates
- CVE-2026-35391 Security feature bypass in webmail
- CVE-2026-34833 Bulwark Webmail: Information Exposure: password returned in /api/auth/session
- CVE-2026-35390 Content-Security-Policy was set to Report-Only mode, failing to block XSS attacks
Sources
Also known as GHSA-4356-876g-rfmh.