listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa
Summary
Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each a...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| knadhlistmonk |
≥ 6.0.0, < 7.0.0-beta.2→ 7.0.0-beta.2 |
7.0.0-beta.2 |
Original description The description as published by the source.
Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin.
Source: CVE.org (CVE Program・cvelistV5) NVD