Is CVE-2026-121452 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121452?

CVE-2026-121452 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-121452

Description

bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.