CVE-2026-33550
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
Scoring
- Severity
- LOW
- CVSS base score
- 2
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
- EPSS probability
- 0.14%
- CWE
- CWE-308
- Published
- 2026-03-22
- Last modified
- 2026-03-23
Affected products
- Alinto SOGo
Weakness type
Related vulnerabilities
- CVE-2026-58240 — Missing Authentication check in SAP NetWeaver (Message Server)
- CVE-2026-85590 — phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
- CVE-2026-67611 — OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
- CVE-2026-56022 — Webmin MFA bypass
- CVE-2024-27928 — Vantage6: 2FA can be circumvented with hacked email access
- CVE-2026-45749 — Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password
- CVE-2025-64103 — Zitadel Bypass Second Authentication Factor
- CVE-2025-42959 — Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476