Quick Summary
Hackers are exploiting an authentication bypass vulnerability in SmarterTools’ SmarterMail, allowing them to reset admin passwords without authentication. This flaw, discovered by watchTowr, was reported on January 8 and patched by January 15, but attackers began exploiting it shortly after. The vulnerability affects only admin accounts, enabling full remote code execution on the host system, which poses significant risks for organizations using SmarterMail.
The Securityish Brief
SmarterTools’ SmarterMail, a self-hosted Windows email server and collaboration platform, has been found to have a serious authentication bypass vulnerability. This flaw allows unauthenticated attackers to reset the system administrator password through the force-reset-password API endpoint, which lacks proper security controls. Researchers at watchTowr reported the issue on January 8, and a fix was released on January 15, but evidence suggests that hackers began exploiting the vulnerability just two days later.
The vulnerability arises from the API endpoint accepting attacker-controlled JSON input, including a property that can force the backend to execute the password reset logic without verifying the old password. This means that anyone who knows or guesses an admin username can hijack the account. The flaw specifically affects admin-level accounts, providing attackers with the ability to run OS commands and achieve full remote code execution.
Evidence of exploitation was gathered from an anonymous tipster who reported unauthorized password resets, corroborated by logs showing attacks targeting the vulnerable endpoint. This situation follows a prior discovery of a critical pre-auth remote code execution flaw in SmarterMail, tracked as CVE-2025-52691, which highlights ongoing security challenges for the platform.
Why This Matters for Your Security
Organizations using SmarterMail should be particularly vigilant due to the implications of this vulnerability. With 15 million users across 120 countries, many small and medium-sized businesses and managed service providers rely on SmarterMail for email services. The ability for attackers to gain admin access can lead to severe data breaches and operational disruptions.
Users are urged to upgrade to the latest version of SmarterMail, Build 9511, which addresses both the recent authentication bypass and the earlier remote code execution flaw. Regular updates and patches are crucial in maintaining security and protecting sensitive information.
This incident underscores the importance of implementing robust security measures, including monitoring for unauthorized access attempts and ensuring that all software is kept up to date. Organizations should also consider additional security layers, such as multi-factor authentication, to protect admin accounts from unauthorized access.
- SmarterMail is a self-hosted Windows email server and collaboration platform developed by SmarterTools.
- The vulnerability allows unauthenticated attackers to reset admin passwords and gain full privileges.
- WatchTowr researchers created a proof-of-concept exploit demonstrating SYSTEM-level shell access.
- The flaw affects only admin-level accounts, not regular users.
- SmarterTools claims its products have 15 million users in 120 countries.
Key Takeaways
- Upgrade to SmarterMail Build 9511 to patch the authentication bypass vulnerability.
- Monitor logs for any unauthorized password reset attempts on admin accounts.
- Implement multi-factor authentication for all admin accounts to enhance security.
- Regularly review and update security policies to address potential vulnerabilities.
- Educate staff about the risks of unauthorized access and the importance of strong passwords.
Key Terms & Concepts
- Authentication Bypass: In this article, authentication bypass refers to a vulnerability that allows attackers to gain unauthorized access without proper credentials.
- Remote Code Execution: Remote code execution is a security vulnerability that allows an attacker to run arbitrary code on a remote machine.
- API Endpoint: An API endpoint is a specific URL where an application can access resources and services provided by a server.
- SmarterMail: SmarterMail is an email server and collaboration platform developed by SmarterTools, used by various organizations for email services.
Read the original article here: https://www.bleepingcomputer.com/news/security/smartermail-auth-bypass-flaw-now-exploited-to-hijack-admin-accounts/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
