SmarterTools SmarterMail Insufficient Entropy Authentication Bypass Vulnerability

November 13th, 2026
ZDI-26-997 ZDI-CAN-33568

CVE ID

CVE-2026-126969

CVSS Score

9.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Vendors

SmarterTools

Affected Products

SmarterMail

Vulnerability Details

This vulnerability allows remote attackers to bypass authentication on affected installations of SmarterTools SmarterMail. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the generation of Application Passwords. The issue results from using insufficient entropy in the generation of credentials. An attacker can leverage this vulnerability to bypass authentication on the system.

Additional Details

Fixed in SmarterMail Build 9735


Disclosure Timeline

  • 2026-08-20 - Vulnerability reported to vendor
  • 2026-11-13 - Coordinated public release of advisory
  • 2026-11-13 - Advisory Updated

Credit

Shaber Tseng

Back to Advisories