CVE-2021-27181: Altn MDaemon

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the anti-CSRF token. In order to exploit this issue, the user has to click on a malicious URL provided by the attacker and successfully authenticate into the application. Having the value of the anti-CSRF token, the attacker may trick the user into visiting his malicious page and performing any request with the privileges of attacked user.

Affected products

• Altn MDaemon: before 20.0.4 (fixed in 20.0.4)

Published 2021-04-14. Last modified 2026-06-17.