Full Disclosure mailing list archives

CVE-2025-68624: Cross-Tenant Authentication Bypass by Spoofing in N-able Mail Assure

CVE ID: CVE-2025-68624
Status: DISPUTED
CWE: CWE-290 (Authentication Bypass by Spoofing)
Affected Product: N-able Mail Assure (formerly SolarWinds MSP Mail Assure)
Affected Service: N-able Mail Assure cloud-based multi-tenant SMTP relay infrastructure
Vendor: N-able Technologies
Initial Discovery: October 2018
Public Disclosure: November 2025, DeepSec Vienna 2025
CVE Assignment: May 2026, following MITRE TL-Root dispute review


== Description ==

N-able Mail Assure contains a design-level authorization flaw that allows an authenticated SMTP user from one tenant to 
submit outbound email using sender addresses belonging to other unrelated tenants hosted on the same platform.

When connecting to the N-able Mail Assure SMTP relay and authenticating with valid credentials, the service accepts 
sender domains that are not bound to, delegated to, or otherwise authorized for the authenticated account. As a result, 
an authenticated user from Tenant A can submit email using a sender address belonging to Tenant B, despite there being 
no administrative relationship, consent, or delegation between the two tenants.

In the observed tests, the SMTP relay verified that the user had valid credentials, but did not verify that the 
authenticated identity was authorized to submit mail for the claimed sender domain.

Where the claimed sender domain authorizes the Mail Assure relay infrastructure in SPF and the message uses an aligned 
RFC5322.From domain, the resulting message can pass SPF and DMARC validation at the receiving MTA, including for 
domains configured with strict DMARC enforcement.

The root cause is a missing sender-domain authorization check at SMTP submission time.


== Impact ==

An authenticated Mail Assure user may be able to impersonate other domains hosted on the Mail Assure platform.

In the observed test case, this produced messages that:

- Passed SPF validation at the receiving MTA
- Passed DMARC validation
- Appeared as authenticated mail to the recipient environment
- Bypassed the protection expected from strict DMARC policies

This issue may enable phishing, Business Email Compromise (BEC), vendor impersonation, and other social engineering 
attacks against organizations that believe their domains are protected by correctly configured SPF and DMARC policies.

A March 2025 analysis documented in the accompanying technical paper identified approximately 17,000 domains relying on 
the Mail Assure platform.


== Proof of Concept Summary ==

The issue was validated using legitimate Mail Assure credentials from a tenant controlled by the researchers.

A controlled test showed that an authenticated account belonging to one Mail Assure tenant could submit an outbound 
message using a sender address belonging to a different, unaffiliated Mail Assure tenant domain.

Observed result:

- Authentication: valid credentials from Tenant A
- Claimed sender domain: Tenant B, unaffiliated with Tenant A
- SMTP result: message accepted for delivery
- Recipient environment: Microsoft 365
- Authentication result: SPF PASS and DMARC PASS
- Target domain policy: strict DMARC enforcement

Full SMTP session transcript, screenshots, and supporting evidence are documented in the technical paper (pages 33-36).

No credentials, tokens, private user data, or mailbox contents are published in this advisory. No harm was caused to 
any third-party domain or its users.


== Disclosure Timeline ==

October 2018       Vulnerability discovered during a penetration test and reported to SolarWinds security contacts.
2018-2024          Issue remained unresolved despite prior notification.
March 2025         Retest performed and issue confirmed as still exploitable.
November 2025      Public disclosure presented at DeepSec Vienna 2025.
December 2025      CVE request submitted to MITRE under Service Request #1964945.
January 2026       N-able PSIRT contacted during the CVE request process. N-able disputed the vulnerability 
classification.
Jan-April 2026     CVE dispute process conducted by MITRE TL-Root.
April 2026         N-able confirmed the cross-tenant sender behavior in correspondence with MITRE TL-Root.
May 2026           MITRE TL-Root determined that the issue meets CVE assignment criteria. CVE-2025-68624 assigned with 
the DISPUTED tag.


== Vendor Response ==

N-able disputes that the reported behavior constitutes a security vulnerability.

N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the 
service does not represent that it enforces per-tenant sender-domain binding.

The CVE record carries the DISPUTED tag to reflect the vendor's position.


== Recommended Mitigation ==

The SMTP relay should enforce sender-domain authorization at submission time.

Recommended controls include:

- Bind authenticated accounts to the domains they are authorized to send from
- Reject outbound messages where the authenticated identity is not authorized for the claimed MAIL FROM and 
RFC5322.From domains
- Require explicit delegation before allowing cross-domain sending
- Log and alert on attempted unauthorized cross-tenant sender-domain usage
- Provide tenant administrators with visibility into authorized sender domains and attempted violations


== References ==

- Technical paper, DeepSec Vienna 2025, Infinity-Day at Scale: Hijacking Registrars, Defeating 2FA and Spoofing 17,000+ 
Domains:
  https://github.com/alessandrobertoldi/research/blob/main/infinity-day-at-scale-deepsec2025.pdf
- Advisory (GitHub Gist):
  https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92
- N-able Mail Assure product page:
  https://www.n-able.com/products/mail-assure
- CVE record:
  https://www.cve.org/CVERecord?id=CVE-2025-68624


== Credits ==

Discovered and reported by:
Alessandro Bertoldi, Bertoldi Cybersecurity
https://bcsec.io/eng.html
https://linkedin.com/in/bertoldicybersecurity

Co-author:
Enrico Bertoldi, Bertoldi Cybersecurity
https://bcsec.io/eng.html

Original 2018 disclosure:
Bertoldi Cybersecurity Team


"Empowering your business with cutting-edge cybersecurity solutions, 
safeguarding your digital assets and ensuring a seamless, secure experience for your customers."
BertoldiCybersecurity
Alessandro Bertoldi

Owner
T. +39 0185 799079

M. +39 348 5130136
E-Mail alessandro () bertoldicybersecurity com
www.bertoldicybersecurity.comhttps://bcsec.io

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• CVE-2025-68624: Cross-Tenant Authentication Bypass by Spoofing in N-able Mail Assure Alessandro Bertoldi BCS via Fulldisclosure (Jun 20)