CVE-2026-93453

SOGo versions prior to 5.12.11 are vulnerable to password-reset token interception caused by trusting the client-supplied Origin header when constructing password-reset links. An unauthenticated attacker can submit a password recovery request with a malicious Origin value, causing the server to e...