CVE-2026-127131

Name of the Vulnerable Software and Affected Versions SOGo versions prior to 5.12.13

Description Missing rate limiting in the web login TOTP (Time-based One-Time Password) verification allows attackers who have a victim's password to brute-force the second-factor code. Because failed TOTP attempts do not increment the failed-login counter and the SOGoMaximumFailedLoginCount setting is not applied, attackers can send repeated POST requests to the '/SOGo/connect' endpoint with incorrect codes at high speed to bypass two-factor authentication.

Recommendations Update to version 5.12.13 or later.