CVE-2026-93453 in SOGo
Summary
by MITRE • 09/18/2026
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in SOGo versions prior to 5.12.11 represents a critical security flaw rooted in improper validation of user-supplied input during the password reset workflow. Specifically, the application constructs the redirect URL for password recovery tokens by directly incorporating the value from the client-supplied Origin HTTP header into the authority component of the link. This design decision fails to enforce strict allow-listing or canonicalization of the origin domain, thereby trusting a header that is easily spoofed by any external party. In standard web security practices, headers such as Origin are intended for informational purposes and should never be used as trusted sources for constructing sensitive URLs or performing critical state changes without rigorous validation against known safe domains.
From an operational perspective, this flaw allows unauthenticated attackers to manipulate the destination of password reset links sent via email. When a victim initiates a password recovery process, SOGo generates a token and embeds it within a URL intended for verification. Due to the vulnerability, if an attacker submits a request with a malicious Origin header pointing to their own controlled domain, the resulting link will direct the user's browser or mail client to that external infrastructure rather than the legitimate application interface. This mechanism effectively bypasses the need for authentication because the attack vector relies on social engineering through email redirection rather than exploiting server-side logic flaws directly during login.
The impact of this vulnerability is severe, as it facilitates account takeover with minimal effort from an attacker. By successfully tricking a victim into clicking or processing a password reset link that points to malicious infrastructure, the attacker can intercept the recovery token if they control the receiving endpoint or manipulate the user interface presented at their domain. Even without direct interception of the email content, directing the verification flow to an untrusted environment allows for potential phishing attacks where users are prompted to enter credentials on a fake login page hosted by the attacker. This undermines the integrity of the authentication system and compromises the confidentiality and availability of user accounts within the SOGo ecosystem.
This vulnerability aligns with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where server-side code uses client-supplied input to construct URLs without proper validation. Additionally, it relates to CWE-601, URL Redirection to Untrusted Site, as the application redirects users or processes data based on unvalidated external inputs. In terms of MITRE ATT&CK tactics, this flaw supports techniques associated with Initial Access and Credential Access, specifically those involving phishing for credentials through manipulated recovery mechanisms. The lack of domain validation in the Origin header processing is a common anti-pattern that security architects must address to prevent such redirection attacks.
To mitigate this vulnerability, organizations running SOGo versions prior to 5.12.11 should immediately upgrade to version 5.12.11 or later, where the issue has been resolved by implementing strict validation of the Origin header against a predefined list of trusted domains. Until an upgrade is feasible, administrators can implement web application firewall rules that inspect and sanitize HTTP headers before they reach the SOGo backend, ensuring that only expected origin values are processed during password reset operations. Furthermore, enforcing Content Security Policy directives that restrict form actions to same-origin or explicitly allowed third-party origins can provide a layer of defense against such redirection attempts. Regular security audits focusing on input validation practices for sensitive workflows like authentication and recovery are essential to prevent similar issues in other components of the application stack.