CVE-2026-126068

A flaw was found in Action Mailbox. The Mailgun ingress controller fails to reject incoming webhook requests with timestamps set in the future and concatenates authentication parameters without a separator when verifying the Hash-based Message Authentication Code HMAC signature. A remote attacker...

GHSA-5957-C7QM-M469 Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress

Impact The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticatorrecent? rejects only timestamps more than 2 minutes in the past...

Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress

Impact The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticatorrecent? rejects only timestamps more than 2 minutes in the past...

CVE-2026-126068

Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and...

CVE-2026-126068

The Action Mailbox Mailgun ingress in Ruby on Rails versions prior to 8.1.4.1 and 8.0.5.2 is vulnerable to a signature replay attack. The root cause is that the system authenticates requests using an HMAC of concatenated timestamp and token parameters without a separator. This lack of boundary de...

CVE-2026-126068 Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress

Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and...

EUVD-2026-122860

Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and...

CVE-2026-126068: rails: Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails

Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and...

Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress

The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticatorrecent? rejects only timestamps more than 2 minutes in the past. Because the...