CVE-2026-114421
Description
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.
Is your site exposed to CVE-2026-114421?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2026-114421? +
How do I check if I'm vulnerable to CVE-2026-114421? +
Related Vulnerabilities
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. …
Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server …
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and …
The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An attacker …
FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already …
