CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
Unauthenticated remote attackers can access operator email digests via an exposed API endpoint in the AetherBrowser Ops server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57443?
CVE-2026-57443 is a high-severity missing authorization vulnerability in issdandavis SCBE-AETHERMOORE, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=["*"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.
Weakness: CWE-306
Which versions are affected by CVE-2026-57443?
3 open source packages ship an affected version, including scbe-aethermoore.
| Package | Affected | Fixed in |
|---|---|---|
scbe-aethermoore PyPI | From 4.0.2 | 4.2.1 |
scbe-aethermoore PyPI | From 4.0.2 | 4.2.1 |
scbe-aethermoore PyPI | From 4.0.2 | 4.2.1 |
How do I fix CVE-2026-57443?
Upgrade scbe-aethermoore to 4.2.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-57443 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57443 exists.
Sources
Also known as GHSA-q986-4x7x-gx39, PYSEC-2026-4163.