{"id":"CVE-2026-127131","kind":"vulnerability","aliases":["CVE-2026-127131"],"related":[],"title":"SOGo: missing rate limit lets attackers brute-force two-factor login codes","description":"SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attackers can send repeated POST requests to /SOGo/connect with wrong verification codes at high speed since failed TOTP attempts never increment the failed-login counter and SOGoMaximumFailedLoginCount does not apply, enabling indefinite guessing across 30-second code windows to bypass two-factor authentication.","summary":"SOGo's web login does not rate-limit its TOTP second-factor check, and failed code attempts do not count toward the failed-login lockout. An attacker who already has a user's password can keep guessing six-digit codes and bypass two-factor authentication.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","groupware","package","self-hosted","sogo"],"not_affected_if":["sogo-5.12.13-or-later","totp-disabled"],"how_to_check":"- Check the installed SOGo version against the fixed version below.\n- Review whether TOTP two-factor authentication is enabled for web logins on the SOGo server.\n- Check whether `SOGoMaximumFailedLoginCount` is set; the sources say it does not apply to TOTP attempts.","fix":"- SOGo: upgrade to `5.12.13` or later.","status":"open","published_at":"2026-11-12T16:19:07+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","triaged_at":"2026-11-12T16:45:36+00:00","updated_at":"2026-11-12T16:45:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T16:45:36Z","model":"claude-haiku-5-5","output":{"fix":"- SOGo: upgrade to `5.12.13` or later.","reach":"internet","title":"SOGo: missing rate limit lets attackers brute-force two-factor login codes","impact":"high","summary":"SOGo's web login does not rate-limit its TOTP second-factor check, and failed code attempts do not count toward the failed-login lockout. An attacker who already has a user's password can keep guessing six-digit codes and bypass two-factor authentication.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sogo","self-hosted","email","groupware"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker logs in as a user and reads their mail and calendar","analyst_note":"","how_to_check":"- Check the installed SOGo version against the fixed version below.\n- Review whether TOTP two-factor authentication is enabled for web logins on the SOGo server.\n- Check whether `SOGoMaximumFailedLoginCount` is set; the sources say it does not apply to TOTP attempts.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["totp-disabled","sogo-5.12.13-or-later"],"who_is_affected":"Organizations running SOGo with TOTP two-factor authentication enabled for web login are exposed, and an attacker must already know the user's password. Deployments without TOTP enabled are not affected by this flaw, as the sources describe it only for TOTP verification.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000741,"input_tokens":4670,"output_tokens":548,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-127131':17A,20A '-2026':16A,19A '/sogo/connect':123C '30':151C '5.12.13':80C 'across':150C 'allow':94C 'alreadi':59B,97C 'appli':146C 'attack':6A,57B,95C,116C 'attempt':46B,134C 'authent':77B,160C 'brute':8A,105C 'brute-forc':7A,104C 'bypass':73B,156C 'check':42B 'code':14A,45B,71B,111C,127C,153C 'contain':81C 'count':49B 'counter':141C 'cve':15A,18A 'digit':70B 'email':21B 'enabl':147C 'factor':12A,41B,76B,110C,159C 'fail':44B,53B,132C,139C 'failed-login':52B,138C 'forc':9A,106C 'groupwar':22B 'guess':67B,149C 'high':129C 'host':26B 'increment':136C 'indefinit':148C 'keep':66B 'let':5A 'limit':4A,36B,85C 'lockout':55B,115C 'login':13A,31B,54B,90C,140C 'miss':2A,83C 'never':135C 'packag':23B 'password':64B,102C 'possess':98C 'post':120C 'rate':3A,35B,84C 'rate-limit':34B 'repeat':119C 'request':121C 'second':40B,109C,152C 'second-factor':39B,108C 'self':25B 'self-host':24B 'send':118C 'sinc':131C 'six':69B 'six-digit':68B 'sogo':1A,27B,28B,78C 'sogomaximumfailedlogincount':143C 'speed':130C 'totp':38B,91C,133C 'toward':50B 'trigger':113C 'two':11A,75B,158C 'two-factor':10A,74B,157C 'user':62B 'verif':92C,126C 'victim':100C 'vulner':86C 'web':30B,89C 'window':154C 'without':112C 'wrong':125C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SOGo with TOTP two-factor authentication enabled for web login are exposed, and an attacker must already know the user's password. Deployments without TOTP enabled are not affected by this flaw, as the sources describe it only for TOTP verification.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","email","groupware","package","selfhosted","sogo"],"campaign_type":null,"search_a":"'-127131':17A,20A '-2026':16A,19A 'attack':6A 'brute':8A 'brute-forc':7A 'code':14A 'cve':15A,18A 'factor':12A 'forc':9A 'let':5A 'limit':4A 'login':13A 'miss':2A 'rate':3A 'sogo':1A 'two':11A 'two-factor':10A","search_b":"'alreadi':59B 'attack':57B 'attempt':46B 'authent':77B 'bypass':73B 'check':42B 'code':45B,71B 'count':49B 'digit':70B 'email':21B 'factor':41B,76B 'fail':44B,53B 'failed-login':52B 'groupwar':22B 'guess':67B 'host':26B 'keep':66B 'limit':36B 'lockout':55B 'login':31B,54B 'packag':23B 'password':64B 'rate':35B 'rate-limit':34B 'second':40B 'second-factor':39B 'self':25B 'self-host':24B 'six':69B 'six-digit':68B 'sogo':27B,28B 'totp':38B 'toward':50B 'two':75B 'two-factor':74B 'user':62B 'web':30B","search_c":"'/sogo/connect':123C '30':151C '5.12.13':80C 'across':150C 'allow':94C 'alreadi':97C 'appli':146C 'attack':95C,116C 'attempt':134C 'authent':160C 'brute':105C 'brute-forc':104C 'bypass':156C 'code':111C,127C,153C 'contain':81C 'counter':141C 'enabl':147C 'factor':110C,159C 'fail':132C,139C 'failed-login':138C 'forc':106C 'guess':149C 'high':129C 'increment':136C 'indefinit':148C 'limit':85C 'lockout':115C 'login':90C,140C 'miss':83C 'never':135C 'password':102C 'possess':98C 'post':120C 'rate':84C 'repeat':119C 'request':121C 'second':109C,152C 'second-factor':108C 'send':118C 'sinc':131C 'sogo':78C 'sogomaximumfailedlogincount':143C 'speed':130C 'totp':91C,133C 'trigger':113C 'two':158C 'two-factor':157C 'verif':92C,126C 'victim':100C 'vulner':86C 'web':89C 'window':154C 'without':112C 'wrong':125C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T16:19:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127131","severity":null,"published_at":"2026-11-12T16:19:07+00:00","modified_at":"2026-11-12T16:19:07+00:00","first_seen_at":"2026-11-12T16:44:02+00:00","fetched_at":"2026-11-12T16:44:02+00:00","note":null}],"documents":[{"id":136541,"url":"https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":136546,"url":"https://www.vulncheck.com/advisories/sogo-before-missing-rate-limiting-on-totp-verification","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}