Description

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

Remediation

References

CVE-2026-62644

Related Vulnerabilities

WordPress Plugin WPFront Notification Bar Cross-Site Scripting (2.0.0.07176)

Django Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2025-27556)

Liferay DXP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-42121)

WordPress CVE-2008-6767 Vulnerability (CVE-2008-6767)

WordPress Plugin Page Showcaser Boxes Cross-Site Scripting (1.1)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-290 CVE-2026-62644