CVE-2026-128333
Deferred Deferred - Pending Action

Authentication Bypass in listmonk via TOTP Skip

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin without the TOTP code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128333
EUVD
EUVD-2026-125044

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
listmonk listmonk to 7.0.0-beta.2 (exc)
knadh listmonk to 7.0.0-beta.2 (exc)
knadh listmonk 7.0.0-beta.1
knadh listmonk 7.0.0-beta.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-304 The product implements an authentication technique, but it skips a step that weakens the technique.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

listmonk versions 6.0.0 to 7.0.0-beta.2 have an authentication bypass flaw in the password reset function. The doResetPassword endpoint allows skipping TOTP verification after a password reset, letting attackers gain full authenticated access including Super Admin privileges by simply completing a reset, such as intercepting a reset email.

Detection Guidance

Check if listmonk versions before 7.0.0-beta.2 are running. Inspect authentication logs for password reset flows that bypass TOTP verification. Look for sessions granted Super Admin access without TOTP codes.

Impact Analysis

Attackers can bypass multi-factor authentication during password resets, gaining unauthorized access to sensitive data or administrative functions. This could lead to data breaches, unauthorized modifications, or full system compromise if the attacker intercepts reset emails.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strong authentication and access controls, such as GDPR's security principles or HIPAA's safeguards for protected health information. Unauthorized access risks data exposure and non-compliance penalties.

Mitigation Strategies

Upgrade listmonk to version 7.0.0-beta.2 or later immediately. Disable password reset functionality if not essential. Review and revoke any unauthorized Super Admin sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128333. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...