CVE-2026-34833

UNKNOWN 0.0

Bulwark Webmail: Information Exposure: password returned in /api/auth/session

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

8th

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.

CWE	CWE-312
Vendor	bulwarkmail
Product	webmail
Published	Apr 2, 2026
Last Updated	Apr 3, 2026

Stay Ahead of the Next One

Get instant alerts for bulwarkmail webmail

Be the first to know when new unknown vulnerabilities affecting bulwarkmail webmail are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

bulwarkmail / webmail

< 1.4.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/bulwarkmail/webmail/security/advisories/GHSA-47pm-883h-885r github.com: https://github.com/bulwarkmail/webmail/releases/tag/1.4.10