Threats affecting pkg:golang/listmonk

Listmonk versions 6.0.0 up to but not including 7.0.0-beta.2 have a critical vulnerability allowing attackers with valid passwords to bypass two-factor authentication (2FA). The flaw lies in improper restriction of authentication attempts, where the attempt counter resets on every new password login, enabling brute-force attacks on TOTP codes. Attackers can repeatedly request fresh tokens via the /admin/login endpoint, each granting 15 additional guesses, potentially compromising 2FA-protected accounts including Super Admin.

listmonk versions 6.0.0 up to but not including 7.0.0-beta.2 have an authentication bypass vulnerability in the password reset process. The vulnerability allows attackers who can complete a password reset—such as by accessing the victim's reset email—to bypass the required TOTP verification step. This results in attackers obtaining fully authenticated sessions, including Super Admin privileges, without needing the TOTP code.

A missing authentication vulnerability in listmonk versions 6.2.0 up to but not including 7.0.0-beta.2 allows unauthenticated attackers to submit forged Azure Event Grid bounce webhooks. This can lead to unauthorized blocking, unsubscribing, or deletion of subscribers via POST requests to the /webhooks/service/azure endpoint. The issue is fixed in version 7.0.0-beta.2.