SmarterMail WT-2026-0001 Authentication Bypass Enables Admin Takeover and RCE

SmarterTools SmarterMail patched a critical authentication bypass tracked as WT-2026-0001 after researchers reported that attackers can reset the system administrator password without authentication by abusing the /api/v1/auth/force-reset-password endpoint. The flaw stems from logic in SmarterMail.Web.Api.AuthenticationController.ForceResetPassword that permits anonymous access and trusts a user-supplied boolean (IsSysAdmin); when set to true, the code path updates an admin account’s password without validating the old password or enforcing authorization checks.

Both reporting indicate the issue is actively exploited in the wild, with observed exploitation occurring within days of the vendor patch (including reports of activity as soon as two days after release). Once an attacker resets the admin password, they can take over the mail server and leverage built-in administrative capabilities to execute OS commands, effectively achieving remote code execution (RCE) and full compromise of affected SmarterMail deployments; the patch was released as Build 9511 following responsible disclosure by watchTowr Labs researchers Piotr Bazydlo and Sina Kheirkhah.