CVE-2026-128332

listmonk 2FA bypass via brute-forced TOTP codes

critical · 9.1

Fix listed

listmonk

Published Nov 13, 2026, 09:33 UTC

Description

Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin.

Reported fixed versions

7.0.0-beta.2

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.