CVE-2026-93453
published 2026-09-18CVE-2026-93453: SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect…
PriorityP349high8.3CVSS 3.1
AVNACLPRNUIRSUCHIHAL
EPSS
0.45%
37.8th percentile
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| alinto | sogo | < 5.12.11 | 5.12.11 |
CVSS provenance
nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Alinto SOGo up to 5.12.10 Password Reset Link Construction Origin redirect
vuldb·2026-09-18·CVSS 8.3
CVE-2026-93453 [HIGH] Alinto SOGo up to 5.12.10 Password Reset Link Construction Origin redirect
A vulnerability classified as problematic was found in Alinto SOGo up to 5.12.10. This affects an unknown function of the component Password Reset Link Construction. The manipulation of the argument Origin results in open redirect.
This vulnerability is identified as CVE-2026-93453. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
GHSA
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled doma
ghsa_unreviewed·2026-09-18
CVE-2026-93453 [HIGH] CWE-640 SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled doma
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/Alinto/sogohttps://github.com/Alinto/sogo/blob/SOGo-5.12.10/UI/MainUI/SOGoRootPage.m#L1375https://github.com/Alinto/sogo/commit/04a3e9823889acaf6c247b224f5f7a0108f8f829https://github.com/Alinto/sogo/commit/382118a93b6925de2ce7f774abc1865ebea2dbbahttps://www.sogo.nu/news/2026/sogo-v51211-released.htmlhttps://www.vulncheck.com/advisories/sogo-before-5.12.11-password-reset-token-interception-via-origin-header
2026-09-18
Published