A vulnerability in SOGo was discovered where the client-supplied Origin header was used when constructing password reset links. This flaw could allow a remote attacker to obtain password reset tokens and potentially take over user accounts. The issue affects certain versions of SOGo and has been fixed in version 5.12.4-1.2ubuntu0.1~esm2. Users are advised to update to the fixed version and restart the SOGo service to apply the patch.