SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 12 Nov 2026 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled. | |
| Title | SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force | |
| Weaknesses | CWE-307 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-12T15:53:16.849Z
Reserved: 2026-11-12T15:11:23.624Z
Link: CVE-2026-127111
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-12T16:19:07.260
Modified: 2026-11-12T16:19:07.527
Link: CVE-2026-127111
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses