CVE-2026-33550
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
Original description
The description as published by the source.
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-33550 sogo
- Ubuntu UBUNTU-CVE-2026-33550 sogo
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com