CVE-2026-35541: Roundcube Webmail Auth Bypass Vulnerability

CVE-2026-35541 Overview

CVE-2026-35541 is a Type Confusion vulnerability discovered in Roundcube Webmail affecting versions before 1.5.14 and 1.6.14. The vulnerability exists in the password plugin where incorrect password comparison logic could allow an attacker to change a user's password without knowing the current password. This flaw stems from the use of loose comparison operators (== and !=) instead of strict comparison operators (=== and !==) in PHP, leading to potential type juggling attacks.

Critical Impact

Authenticated attackers could exploit this type confusion vulnerability to bypass password verification and change account passwords without providing the correct current password, potentially leading to account takeover.

Affected Products

• Roundcube Webmail versions before 1.5.14
• Roundcube Webmail versions before 1.6.14
• Roundcube Webmail versions before 1.7-rc5

Discovery Timeline

• April 3, 2026 - CVE-2026-35541 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35541

Vulnerability Analysis

This vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type - Type Confusion). The flaw exists in the password comparison logic within the plugins/password/password.php file. When users attempt to change their password, the plugin compares the current password input against the stored password and also checks if the new password matches the old one to prevent reuse.

The vulnerable code used PHP's loose comparison operators (== and !=) which perform type coercion before comparison. In PHP, when comparing strings with certain special values or when one operand can be interpreted as a number, type juggling can occur, leading to unexpected true/false results. This allows an attacker to craft specific input values that pass the password validation checks even when the actual password doesn't match.

Root Cause

The root cause is the use of loose comparison operators in PHP for password validation. The vulnerable code used $curpwd != $newpwd and $curpwd == $newpwd for password comparisons. In PHP, loose comparisons can result in type confusion when comparing strings that look like numbers or when dealing with null/empty values. For example, "0" == false evaluates to true in PHP's loose comparison, and similar edge cases could be exploited to bypass the password verification logic.

Attack Vector

The attack is network-based and requires low-privileged access (an authenticated user account). An attacker with valid credentials to a Roundcube Webmail instance could exploit this vulnerability by:

1. Accessing the password change functionality
2. Crafting a specially formatted input that exploits PHP's type juggling behavior
3. Bypassing the current password verification check
4. Successfully changing the account password without knowing the original password

This could be used to maintain persistence after initial compromise or to take over accounts where the attacker has temporary session access.

// Vulnerable code (before patch)
switch ($type) {
    case PASSWORD_COMPARE_CURRENT:
        $result = $curpwd != $newpwd ? $this->gettext('passwordincorrect') : null;
        break;
    case PASSWORD_COMPARE_NEW:
        $result = $curpwd == $newpwd ? $this->gettext('samepasswd') : null;
        break;
}

// Fixed code (after patch)
switch ($type) {
    case PASSWORD_COMPARE_CURRENT:
        $result = $curpwd !== $newpwd ? $this->gettext('passwordincorrect') : null;
        break;
    case PASSWORD_COMPARE_NEW:
        $result = $curpwd === $newpwd ? $this->gettext('samepasswd') : null;
        break;
}

Source: GitHub Commit Update

Detection Methods for CVE-2026-35541

Indicators of Compromise

• Unexpected password change events in Roundcube logs without corresponding legitimate user activity
• Multiple password change attempts from the same session with unusual input patterns
• Password change success events that don't align with user-reported activity
• Anomalous HTTP POST requests to password change endpoints with non-standard parameter values

Detection Strategies

• Monitor Roundcube application logs for password change events and correlate with user activity
• Implement web application firewall (WAF) rules to detect unusual parameter patterns in password change requests
• Review authentication logs for sessions where password changes occurred without proper verification
• Deploy file integrity monitoring on plugins/password/password.php to detect unauthorized modifications

Monitoring Recommendations

• Enable verbose logging for the Roundcube password plugin to capture all password change attempts
• Set up alerts for multiple failed or successful password changes from single IP addresses or sessions
• Monitor for any direct access attempts to password plugin files
• Implement session monitoring to detect potential session hijacking attempts that could precede password change exploitation

How to Mitigate CVE-2026-35541

Immediate Actions Required

• Upgrade Roundcube Webmail to version 1.5.14, 1.6.14, or 1.7-rc5 immediately
• Review recent password change logs for any suspicious activity
• Force password resets for accounts where unauthorized changes are suspected
• Implement additional authentication factors if possible

Patch Information

Roundcube has released security updates that address this vulnerability by replacing loose comparison operators with strict comparison operators in the password plugin. The fix is available in the following versions:

• Roundcube Webmail 1.5.14
• Roundcube Webmail 1.6.14
• Roundcube Webmail 1.7-rc5

For detailed information about the security updates, refer to the Roundcube Security Update announcement.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the password plugin until the update can be applied
• Implement additional server-side password verification outside of Roundcube's built-in mechanism
• Apply strict input validation at the web server or WAF level for password change endpoints
• Monitor and audit all password change activities until patching is complete

# Configuration example - Disable password plugin temporarily
# Edit config/config.inc.php and remove 'password' from plugins array

# Before (vulnerable):
$config['plugins'] = array('password', 'archive', 'zipdownload');

# After (temporary workaround):
$config['plugins'] = array('archive', 'zipdownload');

# Re-enable after updating to patched version