CVE-2026-34834 — Bulwark Webmail: Authentication Bypass in verifyIdentity() due to missing cookie validation
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session…
Published: 2026-04-02 · CVSS: 8.7 · CVSS 4.0
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypass security checks and access/modify user settings via the /api/settings endpoint by providing arbitrary headers. This issue has been patched in version 1.4.10.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7