CVE-2026-114421 Empty initial password permits GINA account takeover

Descripción del fabricante (en inglés)

SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.

Datos de referencia

Fabricante

SEPPmail AG

Productos afectados

• SEPPmail Secure Email Gateway (SEG)

CVSS 4.0

8.3 (HIGH)

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Tipo de debilidad

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

Publicada

4 de noviembre de 2026

Fuentes oficiales

• CVE.org
• NVD
• Aviso del fabricante

← Todas las vulnerabilidades