CVE-2022-24732

CVE-2022-24732 affects Maddy Mail Server prior to 0.5.4, where PAM authentication does not enforce password expiry or account expiry checks. The root cause is missing expiry validation during PAM auth, enabling continued access for expired accounts unless manually filtered. The public description...

CVE-2023-27582

The vulnerability CVE-2023-27582 affects maddy, a composable mail server. Versions 0.2.0 through 0.6.2 allow a full authentication bypass when SASL authorization username is provided with PLAIN authentication; the authorization username is accepted without proper validation, after credential chec...

CVE-2026-40193

The CVE-2026-40193 issue affects maddy (mail server) versions prior to 0.9.3, where user-supplied usernames are interpolated into LDAP search filters and DN templates without escaping. The vulnerability affects three code paths: Lookup() filter, AuthPlain() DN template, and AuthPlain() filter, en...