Skip to main content

Security problem IMAP/POP3 in cPanel

Albert Kruk

Hello, 

One of the current security problems with email is that 2FA enabled for webmail can often be bypassed by using IMAP/POP3 for example with Outlook or Thunderbird. In many cases, access to the mailbox still requires only a username and password. 

Does cPanel plan to introduce a complete, built-in solution for cPanel & WHM that would also secure IMAP/POP3 access?

I mean something like OAuth 2.0 but as a fully integrated and officially supported cPanel feature - not something that administrators have to configure manually. Manual OAuth deployments can be complicated, cause compatibility issues, and be difficult to maintain.

Ideally, the solution should support popular email clients, allow MFA to be enforced, and provide secure token management directly from cPanel & WHM.

I'm opening this topic for discussion, but I believe improving security in this regard is crucial, and this could make cPanel an even better system and desirable in the hosting environment.

 Is cPanel planning something like this? What do you think about it?

Comments

7 comments

Date Votes
  • Ioannis Savvopoulos

    Finally, an actually useful feature request besides AI slop. +1!

    I would also recommend that you submit your idea to the official roadmap:
    https://features.cpanel.net/

    0
  • cPRex Jurassic Moderator

    These are excellent questions, and right now I just don't have these answers.  I do agree these would be best handled through the feature requests site - would you like me to get a request submitted for you?

    1
  • Albert Kruk

    Sure. I would like you to pay special attention to this topic because, nowadays, with AI, email security is becoming more important. Without the right security tools, it can be difficult to protect mailboxes from unauthorized access.

    0
  • cPRex Jurassic Moderator

    Sure thing - I've submitted that and I plan to bring it up with the team during our meeting this coming Friday.

    0
  • Albert Kruk
    • Edited

    cPRex do you have any informations after meeting?

    0
  • cPRex Jurassic Moderator

    I spoke with the team about this and I've created case CPANEL-56131 for our team to add this to their security research.  I've also linked this thread to the case so if I hear any updates on my end I'll be sure to post.

    0
  • Albert Kruk

    Hello, 

    Thank you for the information. Im waiting for new messages.

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post