Sender impersonation via unsigned reply context

Cryptographic signature verification in Mutt and NeoMutt allows attackers to impersonate a signed message sender by changing its reply context. The signing path omits the In-Reply-To value from protected headers, so a valid signature survives when that unsigned field is rewritten. Exploitation requires a previously signed, unencrypted message whose text is misleading in another thread; the result is message-context impersonation, not account access.