---
id: "CVE-2026-127131"
page: "https://infrastack.ai/live/CVE-2026-127131"
kind: "vulnerability"
aliases: ["CVE-2026-127131"]
title: "SOGo: missing rate limit lets attackers brute-force two-factor login codes"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email", "groupware", "package", "self-hosted", "sogo"]
not_affected_if: ["sogo-5.12.13-or-later", "totp-disabled"]
published_at: "2026-11-12T16:19:07+00:00"
first_seen_at: "2026-11-12T16:44:02+00:00"
updated_at: "2026-11-12T16:45:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127131", "first_seen_at": "2026-11-12T16:44:02+00:00"}]
exploit_sources: []
---

# SOGo: missing rate limit lets attackers brute-force two-factor login codes

Link for people: https://infrastack.ai/live/CVE-2026-127131 (this .md is for agents)

SOGo's web login does not rate-limit its TOTP second-factor check, and failed code attempts do not count toward the failed-login lockout. An attacker who already has a user's password can keep guessing six-digit codes and bypass two-factor authentication.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SOGo version against the fixed version below.
- Review whether TOTP two-factor authentication is enabled for web logins on the SOGo server.
- Check whether `SOGoMaximumFailedLoginCount` is set; the sources say it does not apply to TOTP attempts.

## Fix

- SOGo: upgrade to `5.12.13` or later.

## Timeline

- 2026-11-12T16:44:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127131

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/sogo-before-missing-rate-limiting-on-totp-verification
- [fix] Release notes: github.com https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13

## From the sources

SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attackers can send repeated POST requests to /SOGo/connect with wrong verification codes at high speed since failed TOTP attempts never increment the failed-login counter and SOGoMaximumFailedLoginCount does not apply, enabling indefinite guessing across 30-second code windows to bypass two-factor authentication.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_