CVE-2026-128333

Name of the Vulnerable Software and Affected Versions listmonk versions 6.0.0 through 7.0.0-beta.1

Description An authentication bypass exists in the doResetPassword() function. The issue allows the TOTP (Time-based One-Time Password) verification step to be skipped following a password reset. An attacker who can complete the reset process, for example, by accessing the victim's reset email, can obtain a fully authenticated session, including Super Admin privileges, without providing the required TOTP code.

Recommendations Update listmonk to version 7.0.0-beta.2 or later.