Authenticated users of OVH email accounts can change the SMTP envelope‑from and From header values when sending mail through OVH’s servers. Because the default SPF record for many OVH‑hosted domains includes the server at mx.ovh.com, these forged messages are treated as legitimate and pass SPF validation, even though they are not authorized by the domain owner. The vulnerability enables attackers to impersonate any domain hosted on OVH, facilitating phishing and spam distribution that can deceive recipients and defeat standard email authentication checks.

OVHcloud’s mail services for all domains hosted on OVH, particularly those that use the default SPF record with include:mx.ovh.com, are affected. The problem arises for every authenticated user with an OVH email account who can set the envelope‑from From fields when sending messages. No version or patch information is available in the CVE entry.

With a CVSS score of 6.3 the issue is moderate severity, and it is not currently listed as a known exploited vulnerability in CISA KEV. The exploitation requires a valid authenticated account, so the attack vector is internal based on the description. Although the vulnerability does not allow arbitrary code execution, the ability to forge sender addresses undermines trust mechanisms and enables phishing campaigns, which could lead to financial loss or brand damage if the spoofed emails are not detected.