CVE-2026-25602

MEDIUM

Mesalvo Meona Client Launcher <= 19.06.2020 & Server <= 2025.04 - Data Authenticity Verification Bypass

Title source: llm
STIX 2.1

Description

Insufficient Verification of Data Authenticity vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component makes it possible to send messages to any email address. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020.

References (1)

Core 1
Core References
Third Party Advisory third-party-advisory
https://seccore.at/blog/cves-meona/

Scores

CVSS v3 4.4
EPSS 0.0009
EPSS Percentile 0.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-345
Status published
Products (2)
Mesalvo/Meona Client Launcher Component < 19.06.2020 15:11:49
Mesalvo/Meona Server Component < 2025.04 5+323020
Published May 20, 2026
Tracked Since May 20, 2026