BillionMail vulnerabilities

CVEs whose affected-version data names the BillionMail package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111367Medium· 6.5

yesterday

BillionMail through 4.9 Forgeable JWTs via Default Signing Key

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can …

▾ SunlitaaPanel · BillionMailvia CVEORG