Kailash Nadh

A 2FA bypass exists that allows attackers possessing a valid password to brute-force Time-based One-Time Password (TOTP) codes. This occurs because the attempt counter resets every time a new password login is performed. An attacker can repeatedly submit credentials to the 'POST /admin/login' endpoint to obtain fresh tokens, with each token providing 15 additional guesses, potentially granting access to 2FA-protected accounts, including Super Admin sessions.

An authentication bypass exists in the `doResetPassword()` function. The issue allows the TOTP (Time-based One-Time Password) verification step to be skipped following a password reset. An attacker who can complete the reset process, for example, by accessing the victim's reset email, can obtain a fully authenticated session, including Super Admin privileges, without providing the required TOTP code.

listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.