CVE-2026-34833 HIGH

CVE-2026-34833: Bulwark Webmail: Information Exposure: password returned in /api/auth/session

Vendor Bulwarkmail
Product webmail
Weakness CWE-312 · Cleartext storage
Published April 2, 2026
Last update April 3, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.

Key dates

02Disclosure timeline

April 2, 2026 CVE published
April 3, 2026 Record updated