WorldClient email client in MDaemon 2.8 includes the session ID in the referer field of an HTTP request when the user clicks on a URL, which allows the visited web site to hijack the session ID and read the users email.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mdaemon | Alt-n | 2.8 (including) | 2.8 (including) |