Threats tagged 'ghsa-p42g-4rv2-xg2f'

Listmonk versions 6.0.0 up to but not including 7.0.0-beta.2 contain a vulnerability that allows bypassing two-factor authentication (2FA). Attackers with valid passwords can brute-force Time-based One-Time Password (TOTP) codes because the attempt counter resets on each new password login. This enables repeated login attempts via the POST /admin/login endpoint, allowing attackers to gain sessions for 2FA-protected accounts, including Super Admin accounts.