CVE-2026-25602 concerns an insufficient verification of data authenticity (CWE-345) vulnerability in the Mesalvo Meona Client Launcher and Server Components. This weakness allows an attacker to send messages to arbitrary email addresses due to inadequate validation of input data. The vulnerability affects Meona Client Launcher Component versions up to 19.06.2020 15:11:49 and Meona Server Component versions up to 2025.04 5+323020. The CVSS 3.1 score is 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating local attack vector with low complexity and limited confidentiality and integrity impact. There is no vendor advisory or patch available at this time, and no known exploits have been reported.

The vulnerability allows sending messages to any email address by exploiting insufficient verification of data authenticity. This could lead to limited confidentiality and integrity impacts, such as unauthorized message sending or spoofing. There is no reported impact on system availability. No known exploits exist in the wild, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with the affected components and monitor official Mesalvo communications for updates. No official remediation or temporary fixes are currently provided.