CVE-2026-33586 Authenticated SMTP Sender Address Forgery

Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated user with a valid OVH email account can send...

CVE-2026-33586

Authenticated users of OVH mail servers can perform SMTP sender address forgery by manipulating both the "Envelope-from" and "From" fields. This vulnerability stems from the default SPF configuration, which includes include:mx.ovh.com. Consequently, any user with a valid OVH email account can sen...