CVE-2026-67448 is a path confusion vulnerability in Mailpit where percent-encoded URL characters bypass the CORS middleware's path validation, ultimately allowing cross-origin access to the unauthenticated WebSocket endpoint that streams live email metadata. The technical chain is: the CORS layer checks the raw RequestURI for /api/ prefixes, the router operates on percent-decoded URL.Path, and the WebSocket upgrader has CheckOrigin set to true—meaning no origin validation occurs at all. Encode a path like /api/%65vents (decoded to /api/events) and you bypass the CORS check entirely, then reach a WebSocket handler that serves message subjects, sender/recipient fields, and body content without any authentication on default deployments.
The regression framing is the alarming detail. Axllent shipped a WebSocket origin fix in version 1.29.0, presumably addressing percent-encoding bypass—but the same class of vulnerability reappeared in 1.30.6. This wasn't new attack surface; it was the same attack surface that was never actually closed, only covered. The CORS middleware was added or modified after the original WebSocket fix, operating on RequestURI while the router uses URL.Path—two components making locally correct security decisions that globally contradict each other.
The permissive CheckOrigin: true is the deeper failure. This reads as a debugging artifact that survived into production—set to true for local development convenience, never revisited because