Vulnerability · Published Sep 17, 2026 · Assigned by VulnCheck
CVE-2026-93453SOGo before 5.12.11 Password Reset Token Interception via Origin Header
High 8.3
In plain English
A high-severity security flaw in SOGo from Alinto. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sogo | no fix listed | DEBIAN-CVE-2026-93453 |
| Debian:13 | sogo | 5.12.1-3+deb13u3 | DEBIAN-CVE-2026-93453 |
| Ubuntu:26.10 | sogo | no fix listed | UBUNTU-CVE-2026-93453 |
Affected products (as reported)
Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
References
- https://www.sogo.nu/news/2026/sogo-v51211-released.html vendor-advisory
- https://github.com/Alinto/sogo/commit/382118a93b6925de2ce7f774abc1865ebea2dbba patch
- https://github.com/Alinto/sogo/commit/04a3e9823889acaf6c247b224f5f7a0108f8f829 patch
- https://github.com/Alinto/sogo/blob/SOGo-5.12.10/UI/MainUI/SOGoRootPage.m#L1375 technical-description
- https://github.com/Alinto/sogo product
- VulnCheck Advisory: SOGo before 5.12.11 Password Reset Token Interception via Origin Header third-party-advisory