SOGo versions before 5.12.11 are vulnerable to password reset poisoning, allowing unauthenticated attackers to manipulate reset links by injecting malicious values into the Origin header.
PoC
SOGo +1
web-application
credential-theft
cve-2026-93453
1t
1c
updated