Zimbra Collaboration Suite contains a reflected cross‑site scripting flaw in the login page that allows an unauthenticated attacker to inject JavaScript via the zrememberme parameter. The vulnerability is triggered by a crafted relogin URL that forces a two‑factor error display; the unsanitized parameter is inserted into a hidden input attribute, causing the user’s browser to execute attacker code under the legitimate Zimbra origin. The attack can lead to credential capture by replacing the login form with a malicious one, thereby compromising user credentials without requiring an active session.

The flaw affects Zimbra Collaboration Suite versions 10.1.16 and 10.1.17. As of the last advisory, no later releases are listed as impacted. All installations of the listed versions should be treated as vulnerable unless patched to a fixed release.

With a CVSS score of 6.1, the flaw presents a moderate severity risk. The attacker’s only requirement is to entice a user to visit a malicious relogin link; no authentication or privileged state is needed. While the EPSS score is unavailable, the vulnerability’s public disclosure and lack of a KEV listing suggest that exploitation may occur, especially if users are unaware of the malicious link threat.