CVE-2026-34833 - Bulwark Webmail: Information Exposure: password returned in /api/auth/session

Back Back to CVE browser

HIGH

Bulwark Webmail: Information Exposure: password returned in /api/auth/session

Published Apr 2, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.27%

Description

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.

Affected products

Vendor Bulwarkmail Product Webmail Default
n/a
- Version
  < 1.4.10
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bulwarkmail

Webmail

n/a

Version	Status	Constraints
< 1.4.10	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-312

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18530
Advisory
https://github.com/bulwarkmail/webmail/releases/tag/1.4.10
x_refsource_MISCProduct
https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18530		Advisory
https://github.com/bulwarkmail/webmail/releases/tag/1.4.10		x_refsource_MISCProduct
https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r		x_refsource_CONFIRMVendor Advisory