CVE-2026-93453
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
- Published Sep 18, 2026
- CVSS 8.7 high
- 0.5% chance of exploitation in the next 30 days (EPSS)
- A fix is available