Trust & Security
Zimbra CVE-2026-73570 Harvested the Signing Keys That Authenticate Every Session on the Platform
Attackers didn't just read mailboxes — they stole the zimbraAuthTokenKey that signs user session tokens platform-wide, enabling permanent identity compromise that survives password resets.
◆ Heath Callahan