---
id: CVE-2026-104659
title: >-
  Missing Host header validation and missing throttling of failed administrator
  sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0
  through 6.3.5 allow a remote attacker to brute-force the server
  administrator's passwo…
summary: >-
  Missing Host header validation and missing throttling of failed administrator
  sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0
  through 6.3.5 allow a remote attacker to brute-force the server
  administrator's passwo…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-346
vendor: Progressive Robot Ltd
product: hMailServer
affected:
  - hMailServer >= 6.0.0 < 6.3.6
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T11:16:44.013'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-104659'
references:
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6'
    label: cve@gitlab.com
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/work_items/57'
    label: cve@gitlab.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-08T11:31:27.689Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T14:24:38.860426Z'
---

## Overview

Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.