CVE-2026-127131: SOGo before 5.12.13 Missing Rate Limiting on TOTP Verification
SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attackers can send repeated POST requests to /SOGo/connect with wrong verification codes at high speed since failed TOTP attempts never increment the failed-login counter and SOGoMaximumFailedLoginCount does not apply, enabling indefinite guessing across 30-second code windows to bypass two-factor authentication.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SOGoto a version that resolves this vulnerability.Fixed in 5.12.13
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
SOGo versions before 5.12.13 are affected where web login TOTP verification is used. The vulnerable endpoint is /SOGo/connect.
What does an attacker need to exploit it?
An attacker must already know the victim's password. They can then repeatedly submit incorrect TOTP codes without the attempts contributing to the failed-login counter or triggering a lockout.
Does SOGoMaximumFailedLoginCount mitigate repeated TOTP guesses?
No. Failed TOTP verification attempts do not increment the failed-login counter, so SOGoMaximumFailedLoginCount does not limit this attack.
How can administrators identify exploitation attempts?
Look for repeated POST requests to /SOGo/connect associated with an account that has a valid password but repeatedly fails TOTP verification. The supplied information does not indicate that these failures will appear in SOGo's failed-login counter.