Pony Mail HTTP Request Smuggling Vulnerability Leading to Admin Account Takeover

A vulnerability allowing admin account takeover via HTTP request/response smuggling has been identified in Pony Mail's Lua implementation, affecting all versions. This vulnerability arises from an inconsistent interpretation of HTTP requests, which can be exploited to manipulate request handling and potentially gain unauthorized administrative access. While a Python implementation called 'Pony Mail Foal' is in development and not affected by this issue, it has not yet been released. Users of the Lua version are advised to seek alternatives or limit access to trusted users, as this version is no longer supported by the maintainer.

Impact

Exploitation of this vulnerability allows for unauthorized takeover of admin accounts on the affected Pony Mail instance.