EUVD-2026-102507

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribene...

CVE-2026-111367

BillionMail through version 4.9 contains a hard-coded cryptographic key vulnerability (CWE-1394 ) in its JWT implementation. Attackers can compute the cryptographic key from shipped configuration constants to forge unsubscribe and subscribe-confirm tokens. By submitting these forged tokens to the...