EUVD-2026-45174
GHSA-2rg6-hxw2-6rh8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Token disclosure is exploitable by an on-path/adjacent attacker (AV:A) with no auth or interaction (PR:N/UI:N); session hijack yields high confidentiality and integrity impact, no availability effect (A:N).
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.
AnalysisAI
Session hijacking in SEPPmail Secure Email Gateway and SEPPmail Cloud before 15.0.4.2 lets an attacker who can observe traffic replay a victim's GINA web portal session because the session token is exposed both in the URL and in an HTTP header. Because the token travels in the request URL, it can leak into proxy logs, browser history, and Referer headers, enabling account takeover of the secure-message portal. There is no public exploit identified at time of analysis and the CVSS 4.0 exploit-maturity metric is 'Unproven' (E:U); the vendor CVSS 4.0 base score is 7.5.
Technical ContextAI
SEPPmail is an email encryption/secure-messaging gateway; its GINA (Guided Interactive Nomadic Access) web portal is the browser interface external recipients use to read encrypted messages without their own S/MIME or PGP keys. The flaw is classified as CWE-598 (Use of GET Request Method With Sensitive Query Strings), meaning a sensitive session token is placed in the request URL - and additionally in an HTTP header - rather than in a properly scoped, non-loggable cookie. Tokens carried in URLs are persisted in web-server and proxy access logs, browser history, bookmarks, and are transmitted in the Referer header to third-party resources, so the secret is disclosed to any party in that data path. The affected CPE is cpe:2.3:a:seppmail:seppmail_secure_email_gateway_&_seppmail_cloud, covering both the on-premise gateway and the hosted cloud offering.
RemediationAI
Vendor-released patch: upgrade to SEPPmail 15.0.4.2 or later, which per the release notes removes the login redirect that disclosed the session token; SEPPmail Cloud tenants are updated by the vendor. See https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#remove-login-redirect-to-prevent-disclosure-of-session-token-information. Until the upgrade is applied, reduce token leakage by placing GINA behind a reverse proxy that strips session tokens from access logs and suppresses the Referer header on outbound links, restricting network reach to the GINA portal so untrusted adjacent hosts cannot observe traffic, enforcing HTTPS end-to-end to prevent on-path sniffing, and rotating/invalidating existing GINA sessions after upgrade; note these are stopgaps that do not remove the token from the URL itself and can break deployments that rely on the redirect behavior.
Remote code execution in SeppMail secure email gateway versions 15.0.2.1 and earlier allows unauthenticated attackers to
Command injection in SEPPmail Secure Email Gateway before 15.0.1 via PDF encryption password.
SEPPmail Secure Email Gateway before version 15.0.3 allows attackers to bypass subject sanitization and forge security t
SEPPmail Secure Email Gateway before version 15.0.3 fails to properly authenticate inner messages within S/MIME-encrypte
Account takeover in SEPPmail Secure Email Gateway versions before 15.0.3 allows unauthenticated attackers to reset victi
SEPPmail Secure Email Gateway before version 15.0.3 allows remote attackers to bypass subject line sanitization controls
SEPPmail Secure Email Gateway before version 15.0.3 allows remote attackers to inject malicious certificates into S/MIME
SEPPmail Secure Email Gateway versions before 15.0.1 fail to properly validate S/MIME message headers, enabling attacker
Improper filename validation in SEPPmail Secure Email Gateway's GINA web interface (versions before 15.0.1) enables unau
SEPPmail Secure Email Gateway versions prior to 15.0.1 fail to properly isolate decrypted PGP message content from surro
SEPPmail Secure Email Gateway versions before 15.0.1 misinterpret email addresses in message headers, enabling attackers
SEPPmail Secure Email Gateway before version 15.0.3 allows remote attackers to impersonate other users by claiming their
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today