Threats tagged 'ghsa-h254-fw2f-gggx'

listmonk versions 6.0.0 up to but not including 7.0.0-beta.2 contain an authentication bypass vulnerability in the doResetPassword function. This flaw allows attackers who can complete a password reset—such as by accessing the victim's reset email—to bypass TOTP verification and gain fully authenticated sessions, including Super Admin privileges.