# CVE-2026-62644: Roundcube Webmail username spoofing in password plugin

Source: https://junglewise.ai/threats/cve-2026-62644-roundcube-webmail-username-spoofing-in-password-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-62644 · Severity: medium · CVSS 6.4 · Published 2026-07-14

Roundcube Webmail, a popular open-source web-based email client, contains a security flaw in its password management plugin. An attacker could potentially manipulate session data to spoof a different user's identity, leading to unauthorized account access. This could allow a malicious actor to take over email accounts, compromising sensitive communications and personal data.

Technologies: [Roundcube Webmail](https://junglewise.ai/threats/technologies/webmail). Vendors: [Roundcube](https://junglewise.ai/threats/vendors/roundcube).

## Quick answers

**Is CVE-2026-62644 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62644 being exploited in the wild.

**How severe is CVE-2026-62644?** Medium severity, with a CVSS score of 6.4, published 14 July 2026.

**Which products and versions are affected?** Roundcube Webmail before 1.6.17, 1.7.x before 1.7.2.

**Is there a fix for CVE-2026-62644?** A patch was published on 2026-07-05: Security updates 1.6.17 and 1.7.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62644 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-62644?** Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the password plugin of Roundcube Webmail (versions before 1.6.17 and 1.7.x before 1.7.2) classified as authentication bypass by spoofing (CWE-290). The root cause is the improper handling of session-injected usernames within the plugin's drivers (such as LDAP and DirectAdmin). An attacker with low-privileged access could potentially manipulate session data to spoof a different username during password operations. This flaw can be exploited over the network, though it requires high complexity and user interaction, to achieve account takeover. The issue has been addressed in versions 1.6.17 and 1.7.2 by ensuring the username is correctly passed and validated through the save function and driver substitutes.

## Affected products

- Roundcube Webmail before 1.6.17, 1.7.x before 1.7.2

## Timeline

- 2026-07-05: patched: Security updates 1.6.17 and 1.7.2 released
- 2026-07-14: disclosed: CVE-2026-62644 published

## References

- [https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c](https://github.com/roundcube/roundcubemail/commit/5cdc6a48b40beabff7f0bf5d9035f4491e877e4c)
- [https://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231d](https://github.com/roundcube/roundcubemail/commit/7414fef51cd2407d39faab99680763f10ed5231d)
- [https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476](https://github.com/roundcube/roundcubemail/commit/83150ce04d689a70f92d511bcae40adba8d55476)
- [https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923](https://github.com/roundcube/roundcubemail/commit/9a96c20d8c7c9135876b68bebd6960af3ee60923)
- [https://github.com/roundcube/roundcubemail/releases/tag/1.6.17](https://github.com/roundcube/roundcubemail/releases/tag/1.6.17)
- [https://github.com/roundcube/roundcubemail/releases/tag/1.7.2](https://github.com/roundcube/roundcubemail/releases/tag/1.7.2)
- [https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2](https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2)

## Related threats

- [Roundcube Webmail improper authentication in multi-host installations](https://junglewise.ai/threats/cve-2026-114732-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is)
- [Roundcube Webmail uncontrolled resource consumption in CSS proxy](https://junglewise.ai/threats/cve-2026-114731-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is)
- [Roundcube Webmail server-side request forgery filter bypass](https://junglewise.ai/threats/cve-2026-114730-roundcube-webmail-1-6-14-before-1-6-20-and-1-7-0-before-1-7-5-is)
- [Roundcube Webmail content blocking bypass via SVG SMIL](https://junglewise.ai/threats/cve-2026-114729-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is)
- [Roundcube Webmail remote content blocking bypass in CSS FuncIRI handling](https://junglewise.ai/threats/cve-2026-114728-roundcube-webmail-before-1-6-20-and-1-7-x-before-1-7-5-is)