Skip to content
OpenAdvisories

Product · aaPanel

BillionMail

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-111367

    BillionMail through 4.9 Forgeable JWTs via Default Signing Key

    BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens t…

    aaPanel BillionMail