## https://sploitus.com/exploit?id=PACKETSTORM:223955
CVE-2025-68624: Cross-Tenant Authentication Bypass by Spoofing in N-able Mail Assure
CVE ID: CVE-2025-68624
Status: DISPUTED
CWE: CWE-290 (Authentication Bypass by Spoofing)
Affected Product: N-able Mail Assure (formerly SolarWinds MSP Mail Assure)
Affected Service: N-able Mail Assure cloud-based multi-tenant SMTP relay infrastructure
Vendor: N-able Technologies
Initial Discovery: October 2018
Public Disclosure: November 2025, DeepSec Vienna 2025
CVE Assignment: May 2026, following MITRE TL-Root dispute review
== Description ==
N-able Mail Assure contains a design-level authorization flaw that allows an authenticated SMTP user from one tenant to submit outbound email using sender addresses belonging to other unrelated tenants hosted on the same platform.
When connecting to the N-able Mail Assure SMTP relay and authenticating with valid credentials, the service accepts sender domains that are not bound to, delegated to, or otherwise authorized for the authenticated account. As a result, an authenticated user from Tenant A can submit email using a sender address belonging to Tenant B, despite there being no administrative relationship, consent, or delegation between the two tenants.
In the observed tests, the SMTP relay verified that the user had valid credentials, but did not verify that the authenticated identity was authorized to submit mail for the claimed sender domain.
Where the claimed sender domain authorizes the Mail Assure relay infrastructure in SPF and the message uses an aligned RFC5322.From domain, the resulting message can pass SPF and DMARC validation at the receiving MTA, including for domains configured with strict DMARC enforcement.
The root cause is a missing sender-domain authorization check at SMTP submission time.
== Impact ==
An authenticated Mail Assure user may be able to impersonate other domains hosted on the Mail Assure platform.
In the observed test case, this produced messages that:
- Passed SPF validation at the receiving MTA
- Passed DMARC validation
- Appeared as authenticated mail to the recipient environment
- Bypassed the protection expected from strict DMARC policies
This issue may enable phishing, Business Email Compromise (BEC), vendor impersonation, and other social engineering attacks against organizations that believe their domains are protected by correctly configured SPF and DMARC policies.
A March 2025 analysis documented in the accompanying technical paper identified approximately 17,000 domains relying on the Mail Assure platform.
== Proof of Concept Summary ==
The issue was validated using legitimate Mail Assure credentials from a tenant controlled by the researchers.
A controlled test showed that an authenticated account belonging to one Mail Assure tenant could submit an outbound message using a sender address belonging to a different, unaffiliated Mail Assure tenant domain.
Observed result:
- Authentication: valid credentials from Tenant A
- Claimed sender domain: Tenant B, unaffiliated with Tenant A
- SMTP result: message accepted for delivery
- Recipient environment: Microsoft 365
- Authentication result: SPF PASS and DMARC PASS
- Target domain policy: strict DMARC enforcement
Full SMTP session transcript, screenshots, and supporting evidence are documented in the technical paper (pages 33-36).
No credentials, tokens, private user data, or mailbox contents are published in this advisory. No harm was caused to any third-party domain or its users.
== Disclosure Timeline ==
October 2018 Vulnerability discovered during a penetration test and reported to SolarWinds security contacts.
2018-2024 Issue remained unresolved despite prior notification.
March 2025 Retest performed and issue confirmed as still exploitable.
November 2025 Public disclosure presented at DeepSec Vienna 2025.
December 2025 CVE request submitted to MITRE under Service Request #1964945.
January 2026 N-able PSIRT contacted during the CVE request process. N-able disputed the vulnerability classification.
Jan-April 2026 CVE dispute process conducted by MITRE TL-Root.
April 2026 N-able confirmed the cross-tenant sender behavior in correspondence with MITRE TL-Root.
May 2026 MITRE TL-Root determined that the issue meets CVE assignment criteria. CVE-2025-68624 assigned with the DISPUTED tag.
== Vendor Response ==
N-able disputes that the reported behavior constitutes a security vulnerability.
N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.
The CVE record carries the DISPUTED tag to reflect the vendor's position.
== Recommended Mitigation ==
The SMTP relay should enforce sender-domain authorization at submission time.
Recommended controls include:
- Bind authenticated accounts to the domains they are authorized to send from
- Reject outbound messages where the authenticated identity is not authorized for the claimed MAIL FROM and RFC5322.From domains
- Require explicit delegation before allowing cross-domain sending
- Log and alert on attempted unauthorized cross-tenant sender-domain usage
- Provide tenant administrators with visibility into authorized sender domains and attempted violations
== References ==
- Technical paper, DeepSec Vienna 2025, Infinity-Day at Scale: Hijacking Registrars, Defeating 2FA and Spoofing 17,000+ Domains:
https://github.com/alessandrobertoldi/research/blob/main/infinity-day-at-scale-deepsec2025.pdf
- Advisory (GitHub Gist):
https://gist.github.com/alessandrobertoldi/1ebe0f48aa0119d787ac0ff710057d92
- N-able Mail Assure product page:
https://www.n-able.com/products/mail-assure
- CVE record:
https://www.cve.org/CVERecord?id=CVE-2025-68624
== Credits ==
Discovered and reported by:
Alessandro Bertoldi, Bertoldi Cybersecurity
https://bcsec.io/eng.html
https://linkedin.com/in/bertoldicybersecurity
Co-author:
Enrico Bertoldi, Bertoldi Cybersecurity
https://bcsec.io/eng.html
Original 2018 disclosure:
Bertoldi Cybersecurity Team
"Empowering your business with cutting-edge cybersecurity solutions,
safeguarding your digital assets and ensuring a seamless, secure experience for your customers."
BertoldiCybersecurity
Alessandro Bertoldi
Owner
T. +39 0185 799079
M. +39 348 5130136
E-Mail alessandro@bertoldicybersecurity.com
www.bertoldicybersecurity.comhttps://bcsec.io