Description

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

Remediation

References

CVE-2026-62644

Related Vulnerabilities

WordPress Plugin Podlove Podcast Publisher Multiple Cross-Site Scripting Vulnerabilities (2.1.0)

e107 Other Vulnerability (CVE-2004-2039)

Jboss EAP 7PK - Security Features Vulnerability (CVE-2015-5178)

WordPress Plugin Simple Sitemap-Create a Responsive HTML Sitemap Cross-Site Scripting (3.5.7)

PostgreSQL Other Vulnerability (CVE-2000-1199)

Severity

Critical

Classification

CVE-2026-62644 CWE-290 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities