Faceless0X7

**Name of the Vulnerable Software and Affected Versions** SOGo versions prior to 5.12.11 **Description** Unauthenticated attackers can redirect password recovery tokens to domains under their control. This occurs because the software constructs password-reset links using the client-supplied `Origin` header as the authority. By submitting recovery requests with a malicious `Origin` header, attackers can cause valid reset tokens to be sent to victims via links that point to attacker-controlled infrastructure, potentially leading to account takeover. **Recommendations** Update to version 5.12.11 or later.