---
id: 2611
title: "Roundcube XSS chained with cookie tossing for full inbox access"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/roundcube-xss-cookie-tossing"
published_at: "2026-04-21 00:00"
tags: ["ai-security", "attack-chains", "web-security", "xss", "roundcube", "vulnerability-disclosure", "ai-pentesting", "session-hijacking", "csp-bypass", "webmail", "cookie-tossing"]
phying_url: "https://phying.com/item/2611"
lang: en
---

# Roundcube XSS chained with cookie tossing for full inbox access

## Summary

Aikido's AI pentesting agents found a stored XSS in Roundcube's display-attachment endpoint, chained with cookie tossing to hijack webmail sessions and accounts tied to that email. Fixed in 1.6.14.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2026-04-21 00:00
- **Original:** https://www.aikido.dev/blog/roundcube-xss-cookie-tossing
- **Phying News:** https://phying.com/item/2611