Password Reset Vulnerability in SOGo Email Server by Alinto

CVE-2026-93453

What is CVE-2026-93453?

The SOGo email server prior to version 5.12.11 contains a significant vulnerability that allows unauthorized attackers to exploit the password-reset process. By injecting a malicious Origin header when submitting password recovery requests, attackers can redirect valid password-reset tokens to their own domains. This flaw enables the potential for account takeover as attackers can gain access to victims' accounts via recovery links pointing to attacker-controlled sites, posing serious risks to user security.

References