CVE-2026-128332: listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa
Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin.
Affected Software
Event History
Frequently Asked Questions
What must an attacker have before they can exploit this issue?
The attacker needs a valid password for a 2FA-protected Listmonk account. No existing authenticated session or user interaction is required.
Which accounts could be compromised?
Any account protected by TOTP 2FA may be affected, including a Super Admin account. An attacker who successfully brute-forces the TOTP code can obtain an authenticated session.
How is the TOTP guess limit bypassed?
Each successful password login through POST /admin/login yields a fresh token with 15 additional TOTP guesses. Repeating the password-login step resets the effective attempt limit, allowing continued code guessing at /admin/login/twofa.
Which versions are affected?
Listmonk 6.0.0 through versions before 7.0.0-beta.2 are affected. Version 7.0.0-beta.2 is identified as the release containing the fix.