Authentication Bypass and Password-Reset Flaws Enable Account Takeover in SmarterMail and Appsmith

watchTowr Labs disclosed WT-2026-0001, an authentication bypass in SmarterTools SmarterMail that allows a user to reset the system administrator password via a password-reset mechanism and then leverage SmarterMail’s built-in “RCE-as-a-feature” capabilities to execute OS commands. The researcher reported the issue and stated it was patched quickly, citing a fixed release on SmarterMail release 9511 (2026-01-15); the publication was accelerated after a tip that attackers were actively exploiting the flaw to reset admin passwords, with forum-shared logs reportedly showing suspicious activity tied to the force-reset-password endpoint.

Resecurity reported exploitation of CVE-2026-22794 in Appsmith, a critical authentication weakness in the password reset flow where the application trusts a client-controlled Origin header to build reset links. An attacker can initiate a reset for a victim while supplying a malicious Origin so the victim’s email contains a link to attacker infrastructure; when clicked, the reset token is exposed, enabling password change and full account takeover. Resecurity identified the affected endpoint as /api/v1/users/forgotPassword, stated Appsmith ≤ 1.92 is affected, and that the issue is fixed in Appsmith ≥ 1.93.