High, CVSS 7.5PyPIAmendedPublished
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
CVE-2026-57443 · GHSA-q986-4x7x-gx39
- Affected
- PyPI scbe-aethermoore >= 4.0.2, < 4.2.1
- Fixed in
- 4.2.1· Vendor fix available
- Issue
- The AetherBrowser API server (scripts/aetherbrowser/apiserver.py) exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the emailreader.py subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to 0.0.0.0:8100 by default with CORS set to alloworigins=[""], making it reachable from any network or browser origin. This constitutes a critical information-disclosure vulnerability. Details scripts/aetherbrowser/apiserver.py registers the following route at line 3008 (report excerpt references line 2987; the actual line is 3008): No Depends() guard, middleware check, or API-key validation is applied. The decorator is a plain @app.post(...), so FastAPI registers the route with zero access control. The server is bound to all interfaces (line 4065/4070): CORS middleware is…
Recommended action: Upgrade to 4.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.