CVE-2026-128333

EUVD-2026-125044
listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin without the TOTP code.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 46.22%
Common Weakness Enumeration
References
https://github.com/knadh/listmonk/blob/v7.0.0-beta.1/cmd/auth.go#L712-L766
https://github.com/knadh/listmonk/commit/14b25edc31614a1d661e3af72b3d46b887931534
https://github.com/knadh/listmonk/releases/tag/v7.0.0-beta.2
https://www.vulncheck.com/advisories/listmonk-6.0.0-before-7.0.0-beta.2-2fa-bypass-via-password-reset-flow