Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57443— SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests

Quick assessment

Affected
issdandavis SCBE-AETHERMOORE
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SCBE-AETHERMOORE 是一个几何 AI 治理与评估框架。在版本 4.0.2 及更早版本（不包括版本 4.2.1）中，AetherBrowser API 服务器（ ）暴露了 端点，且该端点未实施任何身份验证机制。任何远程攻击者均可调用此端点，从而触发执行 子进程。该子进程通过 IMAP 协议连接至配置好的 ProtonMail 或 Gmail 账户，并在 JSON 响应中返回电子邮件元数据（包括发件人、邮件主题和正文摘要）。默认情况下，服务器绑定于 ，且 CORS（跨域资源共享）配置为 ，允许来自任何网络

CVSS 7.5 · High EPSS 0.57% · P47

Affected Version Matrix 1

VendorProduct Version RangeStatus
issdandavis SCBE-AETHERMOORE >= 4.0.2, < 4.2.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57443

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
Source: CVE Program / CVE List V5
Vulnerability Description
SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server (`scripts/aetherbrowser/api_server.py`) exposes the `POST /api/ops/check-email` endpoint without any authentication. Any remote attacker can call this endpoint and trigger execution of the `email_reader.py` subprocess, which connects to configured ProtonMail or Gmail accounts via IMAP and returns email metadata (sender, subject, body snippet) in the JSON response. The server binds to `0.0.0.0:8100` by default with CORS set to `allow_origins=["*"]`, making it reachable from any network or browser origin. Version 4.2.1 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
issdandavis SCBE-AETHERMOORE >= 4.0.2, < 4.2.1 -

II. Public POCs for CVE-2026-57443

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57443

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-57443 (1)

Vendor Advisories for CVE-2026-57443 (1)

IV. Related Vulnerabilities

Same weakness: CWE-306

V. Comments for CVE-2026-57443

No comments yet

Leave a comment