CVE-2026-35541: Roundcube Webmail Auth Bypass Vulnerability

CVE-2026-35541 Overview

CVE-2026-35541 is a Type Confusion vulnerability discovered in Roundcube Webmail affecting versions before 1.5.14 and 1.6.14. The vulnerability exists in the password plugin where incorrect password comparison logic could allow an attacker to change a user's password without knowing the current password. This flaw stems from the use of loose comparison operators (== and !=) instead of strict comparison operators (=== and !==) in PHP, leading to potential type juggling attacks.

Critical Impact
Authenticated attackers could exploit this type confusion vulnerability to bypass password verification and change account passwords without providing the correct current password, potentially leading to account takeover.

Affected Products

Roundcube Webmail versions before 1.5.14
Roundcube Webmail versions before 1.6.14
Roundcube Webmail versions before 1.7-rc5

Discovery Timeline

April 3, 2026 - CVE-2026-35541 published to NVD
April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35541

Vulnerability Analysis

This vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type - Type Confusion). The flaw exists in the password comparison logic within the plugins/password/password.php file. When users attempt to change their password, the plugin compares the current password input against the stored password and also checks if the new password matches the old one to prevent reuse.

The vulnerable code used PHP's loose comparison operators (== and !=) which perform type coercion before comparison. In PHP, when comparing strings with certain special values or when one operand can be interpreted as a number, type juggling can occur, leading to unexpected true/false results. This allows an attacker to craft specific input values that pass the password validation checks even when the actual password doesn't match.

Root Cause

The root cause is the use of loose comparison operators in PHP for password validation. The vulnerable code used $curpwd != $newpwd and $curpwd == $newpwd for password comparisons. In PHP, loose comparisons can result in type confusion when comparing strings that look like numbers or when dealing with null/empty values. For example, "0" == false evaluates to true in PHP's loose comparison, and similar edge cases could be exploited to bypass the password verification logic.

Attack Vector

The attack is network-based and requires low-privileged access (an authenticated user account). An attacker with valid credentials to a Roundcube Webmail instance could exploit this vulnerability by:

Accessing the password change functionality
Crafting a specially formatted input that exploits PHP's type juggling behavior
Bypassing the current password verification check
Successfully changing the account password without knowing the original password

This could be used to maintain persistence after initial compromise or to take over accounts where the attacker has temporary session access.

php

// Vulnerable code (before patch)
switch ($type) {
    case PASSWORD_COMPARE_CURRENT:
        $result = $curpwd != $newpwd ? $this->gettext('passwordincorrect') : null;
        break;
    case PASSWORD_COMPARE_NEW:
        $result = $curpwd == $newpwd ? $this->gettext('samepasswd') : null;
        break;
}

// Fixed code (after patch)
switch ($type) {
    case PASSWORD_COMPARE_CURRENT:
        $result = $curpwd !== $newpwd ? $this->gettext('passwordincorrect') : null;
        break;
    case PASSWORD_COMPARE_NEW:
        $result = $curpwd === $newpwd ? $this->gettext('samepasswd') : null;
        break;
}

Source: GitHub Commit Update

Detection Methods for CVE-2026-35541

Indicators of Compromise

Unexpected password change events in Roundcube logs without corresponding legitimate user activity
Multiple password change attempts from the same session with unusual input patterns
Password change success events that don't align with user-reported activity
Anomalous HTTP POST requests to password change endpoints with non-standard parameter values

Detection Strategies

Monitor Roundcube application logs for password change events and correlate with user activity
Implement web application firewall (WAF) rules to detect unusual parameter patterns in password change requests
Review authentication logs for sessions where password changes occurred without proper verification
Deploy file integrity monitoring on plugins/password/password.php to detect unauthorized modifications

Monitoring Recommendations

Enable verbose logging for the Roundcube password plugin to capture all password change attempts
Set up alerts for multiple failed or successful password changes from single IP addresses or sessions
Monitor for any direct access attempts to password plugin files
Implement session monitoring to detect potential session hijacking attempts that could precede password change exploitation

How to Mitigate CVE-2026-35541

Immediate Actions Required

Upgrade Roundcube Webmail to version 1.5.14, 1.6.14, or 1.7-rc5 immediately
Review recent password change logs for any suspicious activity
Force password resets for accounts where unauthorized changes are suspected
Implement additional authentication factors if possible

Patch Information

Roundcube has released security updates that address this vulnerability by replacing loose comparison operators with strict comparison operators in the password plugin. The fix is available in the following versions:

For detailed information about the security updates, refer to the Roundcube Security Update announcement.

Workarounds

If immediate patching is not possible, consider temporarily disabling the password plugin until the update can be applied
Implement additional server-side password verification outside of Roundcube's built-in mechanism
Apply strict input validation at the web server or WAF level for password change endpoints
Monitor and audit all password change activities until patching is complete

bash

# Configuration example - Disable password plugin temporarily
# Edit config/config.inc.php and remove 'password' from plugins array

# Before (vulnerable):
$config['plugins'] = array('password', 'archive', 'zipdownload');

# After (temporary workaround):
$config['plugins'] = array('archive', 'zipdownload');

# Re-enable after updating to patched version