Zimbra Collaboration prior to 8.8.10 GA allows text content spoofing via a loginErrorCode value.
synacor zimbra collaboration suite