HarborGuard / CVE
Back to search
HIGHCVE-2026-34833Published Modified CNA GitHub_M

CVE-2026-34833: Bulwark Webmail: Information Exposure: password returned in /api/auth/session

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.

Metrics

CVSS v4.0
8.7
Severity
HIGH
Fixed in
—
Affected Products
1
Affected packages
  • bulwarkmail / webmail
    < 1.4.10
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References