CVE-2026-127111: SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SOGoto a version that resolves this vulnerability.Fixed in 5.12.13
Event History
Frequently Asked Questions
Which accounts are exposed to takeover?
Accounts that use password recovery through secret questions and do not have TOTP enabled are exposed. An attacker can obtain a recovery JWT by guessing the secret-question answer, set a new password, and log in to the account.
Does exploitation require authentication or user interaction?
No. The issue is exploitable remotely by an unauthenticated attacker, and no user interaction is required.
What makes the password-recovery endpoint vulnerable?
The passwordRecoveryCheck endpoint permits unlimited secret-question answer guesses without lockout or rate limiting. A successful guess yields a recovery JWT that can be used to change the password without the existing credential.
What mitigation is available if the affected version cannot be updated immediately?
Enabling TOTP prevents the described full account takeover path for affected accounts. The available fixed release is SOGo 5.12.13.