Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails

Mailpit, an email testing tool, accepts WebSocket connections from any website without checking where the request comes from. An attacker can create a malicious website that secretly connects to a developer's local Mailpit instance to steal emails and server information.

Mailpit versions prior to 1.28.2 lack Origin header validation on WebSocket connections, enabling Cross-Site WebSocket Hijacking (CSWSH). An attacker can exploit this by hosting a malicious site that, when visited by a user running Mailpit locally, establishes an unauthorized WebSocket connection to ws://localhost:8025 to exfiltrate email contents, headers, and server statistics. The vulnerability requires user interaction (visiting the attacker's site) but no authentication.