# SmarterMail auth bypass via an alternate path, CISA KEV

Source: https://startwithidentity.com/cves/cve-2026-23760/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

SmarterMail enforced authentication on the obvious admin path and forgot another. CISA added the CVE to KEV in January 2026. Same class as [Drupal Simple OAuth](https://startwithidentity.com/cves/cve-2025-12466/) and [OAuth2-Proxy](https://startwithidentity.com/cves/cve-2025-54576/).

## Why it matters

Mail servers hold password-reset messages, MFA backup codes, and directory sync credentials. An auth bypass on SmarterMail is an identity incident, not a mail-admin inconvenience. The Zimbra KEV item ([CVE-2025-66376](https://startwithidentity.com/cves/cve-2025-66376/)) is the same lesson on a different product.

## What to do

- Patch SmarterMail to the January 2026 build that names this CVE.
- Take the admin UI off the internet.
- Hunt for new admin users and unexpected mailbox-forwarding rules.

## After you patch

Patching an authentication bypass stops new intrusions. It does not evict anyone already inside, and that is the step most teams skip.

- **Revoke every session and [refresh token](https://startwithidentity.com/glossary/refresh-token/)**, not just the passwords. A session issued before the patch is still valid after it.
- **Enumerate accounts created or modified during the exposure window**, including local accounts on the appliance itself, service accounts, and API tokens.
- **Remove authentication methods you did not add.** An attacker with administrative access enrols a factor so the access survives your remediation.
- **Rotate every credential the compromised system could reach**: directory service accounts used for user lookup, integration keys, and anything in its configuration store. See [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/).
- **Assume the device is a pivot, not a destination.** Check what it could authenticate to and treat that as in scope.

## Sources

- [NVD: CVE-2026-23760](https://nvd.nist.gov/vuln/detail/CVE-2026-23760)
- CISA KEV, January 2026