CVE-2026-111367

BillionMail through version 4.9 contains a hard-coded cryptographic key vulnerability (CWE-1394 ) in its JWT implementation. Attackers can compute the cryptographic key from shipped configuration constants to forge unsubscribe and subscribe-confirm tokens. By submitting these forged tokens to the...