6.5
/ 10
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Description
A cross site websocket hijacking vulnerability exists in Mailpit versions 1.28.1 and below. The vulnerability allows remote attackers to intercept sensitive data such as email contents, headers, and server statistics in real-time...
Basic Information
ID
PACKETSTORM:214780
Published
Feb 2, 2026 at 00:00
Affected Product
Affected Versions
Mailpit - Cross-Site WebSocket Hijacking (CSWSH)
Advisory ID: RO-26-002
CVE ID: CVE-2026-22689
Severity: High
Vendor: axllent
Product: Mailpit
Version: <=1.28.1
Overview #
A Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in Mailpit. The vulnerability allows remote attackers to intercept sensitive data such as email contents, headers, and server statistics in real-time.
Vulnerability Details #
Affected Versions: <=1.28.1
Root Cause: The Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation allows attackers to hijack WebSocket connections.
Vulnerable Code: The vulnerability exists in server/websockets/client.go where the CheckOrigin function is explicitly set to return true for all requests, bypassing standard Same-Origin Policy (SOP) protections provided by the gorilla/websocket library.
var upgrader = websocket.Upgrader{
ReadBufferSize: 1024,
WriteBufferSize: 1024,
CheckOrigin: func(r *http.Request) bool {
return true
},
EnableCompression: true,
}
Exploitation Requirements #
No authentication required.
Victim must visit a malicious website while running Mailpit locally.
Impact #
Remote attackers can exploit this vulnerability to:
Intercept sensitive email data (subjects, bodies, recipients).
Access server statistics.
Receive real-time notifications of new emails.
Proof of Concept #
An attacker can host a malicious website that establishes a WebSocket connection to the victim's Mailpit instance (e.g., ws://localhost:8025/api/events). Since the origin check is disabled, the browser allows this cross-origin connection, leaking all broadcasted events to the attacker.
Solution #
Upgrade to the latest version of Mailpit (1.21.1 or later) which implements proper Origin validation or removes the unsafe check to allow the library's default protection.
References #
GHSA-524m-q5m7-79mm
Timeline:
[2026-01-08] - Reported
[2026-01-09] - Validated
[2026-01-10] - Published
Credits: Omar Kurt
Advisory ID: RO-26-002
CVE ID: CVE-2026-22689
Severity: High
Vendor: axllent
Product: Mailpit
Version: <=1.28.1
Overview #
A Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in Mailpit. The vulnerability allows remote attackers to intercept sensitive data such as email contents, headers, and server statistics in real-time.
Vulnerability Details #
Affected Versions: <=1.28.1
Root Cause: The Mailpit WebSocket server is configured to accept connections from any origin. This lack of Origin header validation allows attackers to hijack WebSocket connections.
Vulnerable Code: The vulnerability exists in server/websockets/client.go where the CheckOrigin function is explicitly set to return true for all requests, bypassing standard Same-Origin Policy (SOP) protections provided by the gorilla/websocket library.
var upgrader = websocket.Upgrader{
ReadBufferSize: 1024,
WriteBufferSize: 1024,
CheckOrigin: func(r *http.Request) bool {
return true
},
EnableCompression: true,
}
Exploitation Requirements #
No authentication required.
Victim must visit a malicious website while running Mailpit locally.
Impact #
Remote attackers can exploit this vulnerability to:
Intercept sensitive email data (subjects, bodies, recipients).
Access server statistics.
Receive real-time notifications of new emails.
Proof of Concept #
An attacker can host a malicious website that establishes a WebSocket connection to the victim's Mailpit instance (e.g., ws://localhost:8025/api/events). Since the origin check is disabled, the browser allows this cross-origin connection, leaking all broadcasted events to the attacker.
Solution #
Upgrade to the latest version of Mailpit (1.21.1 or later) which implements proper Origin validation or removes the unsafe check to allow the library's default protection.
References #
GHSA-524m-q5m7-79mm
Timeline:
[2026-01-08] - Reported
[2026-01-09] - Validated
[2026-01-10] - Published
Credits: Omar Kurt