CVE-2026-128332

Name of the Vulnerable Software and Affected Versions Listmonk versions 6.0.0 through 7.0.0-beta.1

Description A 2FA bypass exists that allows attackers possessing a valid password to brute-force Time-based One-Time Password (TOTP) codes. This occurs because the attempt counter resets every time a new password login is performed. An attacker can repeatedly submit credentials to the 'POST /admin/login' endpoint to obtain fresh tokens, with each token providing 15 additional guesses, potentially granting access to 2FA-protected accounts, including Super Admin sessions.

Recommendations Update Listmonk to version 7.0.0-beta.2.