Improper Restriction of Authentication Attempts in SOGo by Alinto

CVE-2026-127111

What is CVE-2026-127111?

SOGo prior to version 5.12.13 is susceptible to a vulnerability that permits unauthenticated attackers to reset user account passwords. This is achieved through unrestrained guessing of answers to secret questions via the passwordRecoveryCheck endpoint, without any lockout or rate-limiting mechanisms in place. By enabling unlimited submissions of candidate answers, attackers can acquire a valid recovery JWT. This JWT can then be leveraged to change user account passwords without requiring the old credentials. Subsequently, attackers can access the account via the connect endpoint, effectively gaining full control over accounts that do not utilize Time-Based One-Time Password (TOTP) authentication.

References