Email Spoofing Vulnerability in Pretalx Conference Planning Tool

CVE-2026-41426

What is CVE-2026-41426?

The Pretalx conference planning tool has a vulnerability that allows an attacker to exploit user-controlled template placeholders, such as the account display name, to send emails that appear to come from legitimate accounts. This is achieved by registering a malicious account with an arbitrary display name, entering a victim's email, and initiating a password reset. The email delivered appears authentic, bypassing SPF, DKIM, and DMARC checks, thus enabling effective phishing attacks. This issue has been resolved in version 2026.1.0.

References