Improper Cryptographic Signature Verification in SOGo by Alinto

CVE-2026-127121

What is CVE-2026-127121?

A vulnerability exists in SOGo prior to version 5.12.13 that permits remote attackers to exploit improper cryptographic signature verification. By sending a specially crafted multipart/signed message—featuring a mismatched signature and a falsified From address—attackers can substitute a victim's S/MIME contact certificate. This is achieved through the delivery of a CMS signedData object that contains a self-signed certificate. The flaw in SOGo's UIxMailView leads to the storage of this invalid certificate on the contact card without performing proper validation of the signature or identity, allowing attackers to decrypt subsequent encrypted communications using their private key.

References