Zetlyn
GitHubGet started

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the...

zetlyn/cve-ghsa vulnerability ghsa GHSA-fwhq-23fv-8x97 cve CVE-2026-101280 known 2026-09-29

https://github.com/advisories/GHSA-fwhq-23fv-8x97

Properties

cvss7.3
receipt
Source
GitHub advisories
Its words
7.3
Read by
field:cvss.score
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101280",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 5.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-287",
      "name": "Improper Authentication"
    }
  ],
  "description": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-fwhq-23fv-8x97",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-fwhq-23fv-8x97",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-fwhq-23fv-8x97"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101280"
    }
  ],
  "nvd_published_at": "2026-09-29T01:16:44Z",
  "published_at": "2026-09-29T03:30:40Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101280",
    "https://vuldb.com/cve/CVE-2026-101280",
    "https://vuldb.com/submit/918282",
    "https://vuldb.com/vuln/411037",
    "https://vuldb.com/vuln/411037/cti",
    "https://xuyongzhe-vt.github.io/share/opendmarc-multi-record-downgrade.html",
    "https://github.com/advisories/GHSA-fwhq-23fv-8x97"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the...",
  "type": "unreviewed",
  "updated_at": "2026-09-29T03:30:47Z",
  "url": "https://api.github.com/advisories/GHSA-fwhq-23fv-8x97",
  "vulnerabilities": [],
  "withdrawn_at": null
}
cweCWE-287
receipt
Source
GitHub advisories
Its words
CWE-287
Read by
field:cwes[].cwe_id
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101280",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 5.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-287",
      "name": "Improper Authentication"
    }
  ],
  "description": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-fwhq-23fv-8x97",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-fwhq-23fv-8x97",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-fwhq-23fv-8x97"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101280"
    }
  ],
  "nvd_published_at": "2026-09-29T01:16:44Z",
  "published_at": "2026-09-29T03:30:40Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101280",
    "https://vuldb.com/cve/CVE-2026-101280",
    "https://vuldb.com/submit/918282",
    "https://vuldb.com/vuln/411037",
    "https://vuldb.com/vuln/411037/cti",
    "https://xuyongzhe-vt.github.io/share/opendmarc-multi-record-downgrade.html",
    "https://github.com/advisories/GHSA-fwhq-23fv-8x97"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the...",
  "type": "unreviewed",
  "updated_at": "2026-09-29T03:30:47Z",
  "url": "https://api.github.com/advisories/GHSA-fwhq-23fv-8x97",
  "vulnerabilities": [],
  "withdrawn_at": null
}
severitymedium
receipt
Source
GitHub advisories
Its words
medium
Read by
field:severity
Said since
2026-09-29 09:48 UTC
Last answered
2026-10-06 13:46 UTC
Original
open at the source
What the source handed over
{
  "credits": [],
  "cve_id": "CVE-2026-101280",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 5.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-287",
      "name": "Improper Authentication"
    }
  ],
  "description": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-fwhq-23fv-8x97",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-fwhq-23fv-8x97",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-fwhq-23fv-8x97"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-101280"
    }
  ],
  "nvd_published_at": "2026-09-29T01:16:44Z",
  "published_at": "2026-09-29T03:30:40Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-101280",
    "https://vuldb.com/cve/CVE-2026-101280",
    "https://vuldb.com/submit/918282",
    "https://vuldb.com/vuln/411037",
    "https://vuldb.com/vuln/411037/cti",
    "https://xuyongzhe-vt.github.io/share/opendmarc-multi-record-downgrade.html",
    "https://github.com/advisories/GHSA-fwhq-23fv-8x97"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the...",
  "type": "unreviewed",
  "updated_at": "2026-09-29T03:30:47Z",
  "url": "https://api.github.com/advisories/GHSA-fwhq-23fv-8x97",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the... A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.