CVE-2026-128332 · Package
NO FIX YET · SEE WHAT TO DO
Listmonk 6.0.0 before 7.0.0-beta.2 resets its TOTP attempt counter on every new password login. An attacker with a valid password can keep logging in to get fresh tokens, each allowing 15 more guesses, and eventually gets a session on 2FA-protected accounts, including Super Admin.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Listmonk instances running version 6.0.0 before 7.0.0-beta.2 that have TOTP two-factor authentication enabled are exposed, since the flaw is in the login flow that checks 2FA codes. An attacker still needs a valid password for the account. Instances on other versions, or without 2FA accounts, are not affected per the sources.
Not affected if auth-required, default-config
Who cares email-marketing, listmonk, self-hosted
listmonk --version or the admin footer); versions 6.0.0 up to but not including 7.0.0-beta.2 are affected./admin/login from a single source.7.0.0-beta.2 or later.Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.