CVE-2026-128333 · Package
NO FIX YET · SEE WHAT TO DO
listmonk 6.0.0 before 7.0.0-beta.2 skips two-factor (TOTP) verification after a password reset. An attacker who can complete a reset, for example by reading the victim's reset email, gets a fully authenticated session, including Super Admin.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run listmonk 6.0.0 before 7.0.0-beta.2 and use TOTP two-factor login on admin accounts are exposed, since the reset path skips the TOTP check. Anyone who can read the reset email (or otherwise complete a reset) can get an admin session. Instances on other versions, or without TOTP enabled, are not covered by this flaw.
Not affected if totp-disabled, version-outside-range
Who cares email-marketing, listmonk, self-hosted, totp
6.0.0 to 7.0.0-beta.2 (exclusive)7.0.0-beta.2 or laterlistmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin without the TOTP code.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.