Discovered by s3cure

Risk: small

When we are logged on account we see:

http://site.site/cgi-bin/openwebmail...ges_afterlogin

Now we can do small xss:

http://site.site/cgi-bin/openwebmail...*-session-here xss&action=listmessages_afterlogin

Ofcourse we can do a lots of other things but ... It's now your job.