SmarterMail auth bypass flaw now exploited to hijack admin accounts
Recorded: Jan. 22, 2026, 10:03 p.m.
| Original | Summarized |
SmarterMail auth bypass flaw now exploited to hijack admin accounts News Featured Zendesk ticket systems hijacked in massive global spam wave Hackers breach Fortinet FortiGate devices, steal firewall configs Fake Lastpass emails pose as password vault backup alerts Hackers exploit 29 zero-days on second day of Pwn2Own Automotive Okta SSO accounts targeted in vishing-based data theft attacks This $35 Swifdoo PDF editor license lasts for life Curl ending bug bounty program after flood of AI slop reports SmarterMail auth bypass flaw now exploited to hijack admin accounts Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecuritySmarterMail auth bypass flaw now exploited to hijack admin accounts SmarterMail auth bypass flaw now exploited to hijack admin accounts By Bill Toulas January 22, 2026 Hackers began exploiting an authentication bypass vulnerability in SmarterTools' SmarterMail email server and collaboration tool that allows resetting admin passwords. Researchers at cybersecurity company watchTowr reported the issue on January 8, and SmarterMail released a fix on January 15 without an identifier being assigned. Executing the exploitSource: watchTowr Logs indicating active exploitationSource: watchTowr The 2026 CISO Budget Benchmark Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Fortinet admins report patched FortiGate firewalls getting hacked Ingram Micro says ransomware attack affected 42,000 people Tesla hacked, 37 zero-days demoed at Pwn2Own Automotive 2026 Sponsor Posts Identity Governance & Threat Detection in one: Get a guided tour of our platform Overdue a password health-check? Audit your Active Directory for free Discover how phishing kits are sold and deployed. Download the full research report. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
This BleepingComputer article details a critical security vulnerability impacting SmarterMail, a self-hosted email server and collaboration platform. The flaw, identified and subsequently exploited by threat actors, centers around an authentication bypass within the ‘force-reset-password’ API endpoint. This endpoint, intentionally exposed without authentication checks, permits unauthenticated attackers to reset administrator passwords and gain full administrative privileges. The vulnerability’s existence was initially reported by cybersecurity firm watchTowr on January 8, 2026. Crucially, watchTowr observed active exploitation of the flaw just two days later, indicating rapid reverse-engineering and utilization by malicious actors. The core issue stems from the API endpoint accepting attacker-controlled JSON input, particularly the ‘IsSysAdmin’ boolean property. When set to ‘true’, this property forces the backend to execute the system administrator password reset logic without any security controls or verification of the old password. As a result, any user possessing a basic understanding of the system could reset an administrator’s password. The impact of successful exploitation is substantial, granting attackers SYSTEM-level shell access and, therefore, the ability to execute arbitrary commands on the host system. watchTowr provided a proof-of-concept exploit to demonstrate the vulnerability’s functionality. Evidence of active exploitation was gleaned from a public forum post, which corroborated watchTowr’s findings and highlighted a specific incident of password resets. Prior to this discovery, watchTowr had previously identified a critical pre-authentication remote code execution (RCE) vulnerability, tracked as CVE-2025-52691, within SmarterMail. This underscores a pattern of vulnerability exposure within the platform. SmarterTools released a patch, Build 9511, on January 15, 2026, addressing both the authentication bypass and the RCE vulnerability. Users are strongly advised to upgrade to this latest version. The article highlights the broader security landscape, referencing related incidents such as hacks targeting Fortinet firewalls and Palo Alto Networks PAN-OSH. It also reinforces the importance of proactive security measures in managing vulnerable systems. The piece ultimately serves as a timely warning to SmarterMail users, urging immediate action to mitigate the risk of compromise. |