Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-93453: SOGo password reset links can be hijacked
CVE-2026-93453 · published 29 days ago
Summary
In SOGo versions before 5.12.11, the system builds password‑reset URLs using a value supplied by the user’s browser. An attacker can trick the server into placing their own domain in that value, causing the reset email to contain a link that points to the attacker’s site and giving them the password‑reset token. Upgrade SOGo to version 5.12.11 or later, or apply the vendor’s recommended configuration change to stop using the client‑provided Origin header for link generation.
What to do
- Update debian sogo to version 5.12.1-3+deb13u3.
- Update alinto sogo to version 5.12.11 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | alinto | sogo | < 5.12.11 |
| Debian:12 | debian | sogo | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | sogo | All versions |
| Debian:13 | debian | sogo |
< 5.12.1-3+deb13u3 Fix: upgrade to 5.12.1-3+deb13u3
|
Original advisory text
SOGo before 5.12.11 Password Reset Token Interception via Origin Header
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
References
- https://www.vulncheck.com/advisories/sogo-before-5.12.11-password-reset-token-in... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93453... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-93453 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-93453 Vendor Advisory
- https://github.com/Alinto/sogo/blob/SOGo-5.12.10/UI/MainUI/SOGoRootPage.m#L1375 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-93453 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-93453 Third Party Advisory
- https://github.com/Alinto/sogo Third Party Advisory
- https://github.com/Alinto/sogo/commit/04a3e9823889acaf6c247b224f5f7a0108f8f829 Third Party Advisory
- https://github.com/Alinto/sogo/commit/382118a93b6925de2ce7f774abc1865ebea2dbba Third Party Advisory
- https://www.sogo.nu/news/2026/sogo-v51211-released.html Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-640Weak Password Recovery Mechanism for Forgotten Password
Timeline
Published18 Sep 2026
Updated17 Oct 2026
First seen17 Sep 2026
Sources
CVE-2026-93453 · NVD
CVE-2026-93453 · MITRE
CVE-2026-93453 · OSV
DEBIAN-CVE-2026-93453 · OSV
UBUNTU-CVE-2026-93453 · OSV
Track software like this
Free during beta