CVE-2026-57443: SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
Summary
CVE-2026-57443: SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests. Affects scbe-aethermoore versions >= 4.0.2, < 4.2.1. Fixed in 4.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SCBE-AETHERMOORE is an open-source project that provides a web-based interface for managing and interacting with various email services, including ProtonMail and Gmail. The application allows users to check their emails through an API, facilitating seamless integration with other services. However, a critical vulnerability exists in the AetherBrowser API server that exposes sensitive email metadata without requiring authentication, making it susceptible to exploitation by unauthorized users.
Vulnerability Detail
The vulnerability arises from the AetherBrowser API server's POST /api/ops/check-email endpoint, which is accessible without any authentication checks. This lack of access control allows any remote attacker to invoke the endpoint, triggering the execution of the email_reader.py subprocess. This subprocess connects to configured email accounts via IMAP and returns sensitive email metadata, including sender addresses, subjects, and body snippets, in the JSON response. The server's default configuration binds to all interfaces (0.0.0.0:8100) and allows cross-origin requests from any origin, further exacerbating the risk of unauthorized access. The vulnerability can lead to significant information disclosure, including the exfiltration of operator email data and potential account alerts due to repeated IMAP login attempts.
How To Fix
Minimum fixed version
4.2.1
This is the first release that contains the fix.
pip install --upgrade "scbe-aethermoore==4.2.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the API server by binding it to 127.0.0.1 instead of 0.0.0.0, which limits exposure to local requests only. Additionally, you can disable CORS or configure it to allow only trusted origins.
Conclusion
CVE-2026-57443 represents a significant security risk for users of the SCBE-AETHERMOORE package due to its unauthenticated API endpoint that exposes sensitive email metadata. It is crucial to update to the patched version and implement proper access controls to mitigate this vulnerability.
See every vulnerability recorded for scbe-aethermoore →
FAQ
CVE-2026-57443 is a vulnerability in the SCBE-AETHERMOORE package that allows unauthenticated access to sensitive email metadata through an exposed API endpoint.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The risks include unauthorized access to sensitive email information, potential data exfiltration, and the possibility of triggering account alerts due to repeated login attempts.
To secure your application, update to version 4.2.1 or later of SCBE-AETHERMOORE and implement API-key validation for sensitive endpoints.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
