AIKIDO-2026-481629

TL;DR

The email plugin opens SMTPS and STARTTLS connections without passing an ssl context, so smtplib falls back to an unverified stdlib context that does not validate the certificate chain or hostname. The URL-level verify_certificate setting, which defaults to enabled, is silently ignored for the SMTP TLS handshake, so a self-signed or hostname-mismatched certificate is accepted before credentials or message data are sent. An attacker able to intercept or redirect SMTP traffic can present an untrusted certificate, complete the handshake, and capture SMTP credentials and notification contents. The fix builds an ssl context from verify_certificate and passes it to both SMTP_SSL and starttls.