← Monday, October 5, 2026SecurityVulnerability

Two SMTP parsing flaws enabled email spoofing through Apple iCloud

sec-consult.com 16 min read Editor score 7/10

A case study describes two email spoofing vulnerabilities in iCloud’s SMTP infrastructure and revisits SMTP smuggling after implementations adopted fixes. It offers a concrete look at how parser behavior can undermine email identity checks.

What

Researchers found two Apple iCloud email spoofing vulnerabilities involving header smuggling, a subclass of email spoofing based on parsing discrepancies.

How

SMTP smuggling exploits differences between outbound and inbound servers in how they interpret message boundaries; the iCloud case enabled arbitrary icloud.com sender identities.

Why it matters

The findings highlight how parser differences in widely used protocols can undermine identity checks and email trust.

Read on sec-consult.com → Lobsters

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.