CVE-2026-62644CWE-290

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data…

Medium · published July 14, 2026

CVSS v3.1
6.4
EPSS
1%
Percentile
41.9
In the wild
Unconfirmed
What it is

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00500 · 41.9th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-07-14T15:55Z
EPSS history
Timeline
  • 14 JUL 15:55Z
    In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data…
    cvelistv5