CSRF Vulnerability in Zimbra Collaboration Affects Password Reset Functionality

CVE-2025-54390

What is CVE-2025-54390?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the ResetPasswordRequest operation of Zimbra Collaboration Suite (ZCS). When the zimbraFeatureResetPasswordStatus attribute is enabled, an attacker can exploit this vulnerability by tricking an authenticated user into visiting a malicious webpage. This malicious site can silently execute a crafted SOAP request to reset the user's password without their consent, exploiting the lack of CSRF token validation on the endpoint. This presents a serious threat to the security and integrity of user accounts within the Zimbra platform.

References