SOGo: TOTP authentication bypass (CVE-2026-127131)

SOGo versions before 5.12.13 are vulnerable to an authentication bypass due to missing rate limiting on TOTP verification. Attackers who possess a valid user password can conduct indefinite brute-force attacks against the TOTP second-factor because failed verification attempts do not increment the login failure counter, and the SOGoMaximumFailedLoginCount configuration setting does not apply to these attempts.

Impact

Attackers can bypass multi-factor authentication by programmatically guessing TOTP codes. This exposes accounts to unauthorized access if a primary password has already been compromised.

Recommendation

• Upgrade SOGo to version 5.12.13 or later immediately to apply the rate limiting fix.
• Review authentication logs for patterns of high-frequency failed TOTP attempts originating from single user accounts or IP addresses.
• Audit existing user passwords for compromise, as the threat relies on prior acquisition of the password.