Missing Rate Limiting in SOGo Web Login TOTP Verification
CVE-2026-127131

9.1CRITICAL

Key Information:

Vendor

Alinto

Status
Sogo
Vendor
CVE Published:
12 November 2026

What is CVE-2026-127131?

A missing rate limiting vulnerability in SOGo prior to version 5.12.13 allows attackers to exploit the TOTP verification process. By leveraging this vulnerability, individuals who already possess a victim's password can continuously attempt brute-force attacks on the second-factor codes. This occurs without triggering lockout mechanisms, as failed attempts do not count towards the failed-login threshold. Attackers can input incorrect TOTP verification codes at an accelerated pace, effectively bypassing two-factor authentication and compromising accounts over a window of 30 seconds, thereby enhancing the risk of unauthorized access.

Affected Version(s)

sogo 0 < 5.12.13

References

https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13
patchrelease-notes
https://www.vulncheck.com/advisories/sogo-before-missing-...
third-party-advisory

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Richard OlszynskĂ˝
.