SOGo before 5.12.13 Missing Rate Limiting on TOTP Verification
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Alintosogo |
< 5.12.13→ 5.12.13 |
5.12.13 |
Fix status by distribution
Records published by each distribution for this CVE. Fixed versions differ by release; check each link.
- Debian DEBIAN-CVE-2026-127131 sogo No fixed version in this record
Original description The description as published by the source.
SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attackers can send repeated POST requests to /SOGo/connect with wrong verification codes at high speed since failed TOTP attempts never increment the failed-login counter and SOGoMaximumFailedLoginCount does not apply, enabling indefinite guessing across 30-second code windows to bypass two-factor authentication.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory vulncheck.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com