Medium · 4.6 CVE-2025-52373 EUVD-2025-22113GHSA-244x-c938-j3qj

Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in databas…

Published Jul 21, 2025 · Updated Jul 22, 2025 · Assigned by mitre

Description

Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file.

References

https://github.com/mojibake-dev/hMailEnum
https://github.com/hmailserver/hmailserver
https://github.com/mojibake-dev/mojibake-CVE/blob/main/hMailServer/CVE-2025-52373.md