CVE-2026-93631

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...

CVE-2026-93631

A cross-site request forgery (CSRF) vulnerability exists in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition versions 10.1.16 and 10.1.20 . The flaw stems from the OAuth callback failing to bind its state value or authorization code to the initiating Zimbra session, instead...

EUVD-2026-108972

A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite ZCS Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating...