CVE-2026-93638: Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter
A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input attribute without HTML encoding. A victim who opens the URL receives attacker-controlled script and page content under the legitimate Zimbra origin, allowing credential capture through a replacement login form. The relogin path logs out an existing session before rendering the payload, so the demonstrated attack does not inherit that session's mailbox access. ZCS 10.1.16 and 10.1.17 are affected.
Affected Software
Event History
Frequently Asked Questions
Which deployments are known to be affected?
Zimbra Collaboration Suite versions 10.1.16 and 10.1.17 are affected. The vulnerable functionality is the login page, so systems exposing that page to users are relevant to triage.
What does an attacker need to exploit this issue?
An attacker does not need authentication and can use a crafted relogin URL containing a malicious zrememberme parameter. Exploitation requires a victim to open the crafted URL.
Can this vulnerability directly give an attacker access to an already logged-in mailbox session?
The relogin path logs out the victim's existing session before it renders the injected content. The demonstrated attack therefore does not inherit the existing session's mailbox access, but can present a replacement login form to capture credentials.
What is the practical impact of successful exploitation?
Attacker-controlled JavaScript and page content execute under the legitimate Zimbra origin. This can enable credential capture through a forged login form presented to the victim.