CVE-2026-40193

A flaw was found in maddy, a composable mail server. This LDAP Lightweight Directory Access Protocol injection vulnerability allows a remote attacker to inject arbitrary LDAP filter expressions into username fields during authentication. By exploiting this, an attacker can achieve identity...

GHSA-5835-4GVC-32PC Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username

Summary The auth.ldap module constructs LDAP search filters and DN strings by directly interpolating user-supplied usernames via strings.ReplaceAll without any LDAP filter escaping. An attacker who can reach the SMTP submission AUTH PLAIN or IMAP LOGIN interface can inject arbitrary LDAP filter...