Authentication bypass in SmarterMail (CVE-2026-23760) — an anonymous call to the password reset endpoint takes over an administrator account, and the product has reached KEV three times
SmarterTools SmarterMail contains an authentication bypass in its password reset API. The force-reset-password endpoint permits anonymous requests and does not verify an existing password or a reset token when resetting system administrator accounts, so an unauthenticated attacker supplying a target administrator username and a new password can take full administrative control of the instance.
Key facts
- CVE IDCVE-2026-23760
- Affected (vendor / product)SmarterTools SmarterMail
- CWECWE-288
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2026-02-16 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is SmarterTools SmarterMail; CWE-288, authentication bypass using an alternate path or channel.
- The force-reset-password endpoint permits anonymous requests and verifies neither the existing password nor a reset token for administrator accounts.
- An unauthenticated attacker supplying a target administrator username and a new password can take full administrative control of the instance.
- Added to KEV 2026-01-26 with a due date of 2026-02-16. Use in ransomware campaigns is recorded as known.
- This site holds three SmarterMail records; two were added on the same day (2026-01-26) and all three are ransomware-known.
- Two of the three SmarterMail entries were added on 2026-01-26 and one on 2026-02-05, all known in ransomware.
1Not the lock but the back-door procedure
Authentication bypass comes in several forms; what CWE-288 names is a state in which one gets inside by a route other than the intended one. Here that other route was the password reset procedure. However hard the login screen is made, if anyone can call the endpoint that recreates a password, there is no need to break the lock — a new one can simply be made.
The strength of authentication depends not only on authentication itself but on how the paths for changing credentials are guarded.
2It verifies neither the existing password nor a token
The catalog is specific. The reset endpoint accepts anonymous requests, and when the target is a system administrator account it verifies neither the existing password nor a reset token. Ordinarily resetting a password requires something showing you are who you claim: entering the current password, or using a token delivered by mail. With neither checked, all that is needed is knowing the target administrator username. Almost nothing remains as a requirement for the attack to succeed.
3Three records for one product, two on the same day
The KEV records this site holds include three for SmarterMail. This one and an unrestricted file upload (CVE-2025-52691) were added on the same day, 2026-01-26, and a missing authentication for a critical function (CVE-2026-24423) followed on 2026-02-05. All three are recorded as known to be used in ransomware campaigns.
Several exploited vulnerabilities surfacing from one product in a short window points less to individual faults than to that product drawing attacker attention. Handling entries one at a time makes that concentration invisible.
Why it matters
Reviewing an authentication design means more than checking the strength of login. Password reset, account recovery and initialization — every path capable of recreating a credential — need the same protection. Where several records surface from one product in a short period, it is a prompt to reconsider that product exposure itself rather than only to apply each fix.
FAQ
What is an authentication bypass here?
What does an attack require?
Is one product recurring unusual?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).