CVE-2026-128333: listmonk 6.0.0 before 7.0.0-beta.2 2FA Bypass via Password Reset Flow
listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin without the TOTP code.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be able to complete a password-reset flow for the target account. One stated example is access to the victim's password-reset email; no existing listmonk account or TOTP code is required.
Which accounts are at risk after exploitation?
A successful password reset produces a fully authenticated session without TOTP verification. This includes Super Admin accounts when the attacker can complete the reset for such an account.
Which versions are affected and what version addresses the issue?
The issue affects listmonk 6.0.0 through versions before 7.0.0-beta.2. Version 7.0.0-beta.2 includes the referenced fix.