{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asogosogo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sogo:sogo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-127131"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SOGo (\u003c 5.12.13)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SOGo"],"content_html":"\u003cp\u003eSOGo versions before 5.12.13 are vulnerable to an authentication bypass due to missing rate limiting on TOTP verification. Attackers who possess a valid user password can conduct indefinite brute-force attacks against the TOTP second-factor because failed verification attempts do not increment the login failure counter, and the SOGoMaximumFailedLoginCount configuration setting does not apply to these attempts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAttackers can bypass multi-factor authentication by programmatically guessing TOTP codes. This exposes accounts to unauthorized access if a primary password has already been compromised.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade SOGo to version 5.12.13 or later immediately to apply the rate limiting fix.\u003c/li\u003e\n\u003cli\u003eReview authentication logs for patterns of high-frequency failed TOTP attempts originating from single user accounts or IP addresses.\u003c/li\u003e\n\u003cli\u003eAudit existing user passwords for compromise, as the threat relies on prior acquisition of the password.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T16:50:53Z","date_published":"2026-11-12T16:50:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-sogo-totp-bypass-cve-2026-127131/","summary":"SOGo versions prior to 5.12.13 contain a vulnerability in TOTP verification that allows brute-force of second-factor codes, enabling attackers with valid passwords to bypass multi-factor authentication.","title":"SOGo: TOTP authentication bypass (CVE-2026-127131)","url":"https://feed.craftedsignal.io/briefs/2026-11-sogo-totp-bypass-cve-2026-127131/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sogo:sogo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-127111"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SOGo (\u003c 5.12.13)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SOGo"],"content_html":"\u003cp\u003eSOGo versions prior to 5.12.13 contain an improper restriction of excessive authentication attempts in the password recovery process. An unauthenticated attacker can repeatedly guess secret-question answers via the passwordRecoveryCheck endpoint without rate limiting or lockout protections. Successful brute-forcing allows the attacker to obtain a recovery JWT, which can then be used to reset an account password without requiring the old credential. This results in full account takeover for accounts not protected by time-based one-time passwords (TOTP).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target account with a configured secret question.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the passwordRecoveryCheck API endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker submits repeated, automated requests containing guessed answers to the secret question.\u003c/li\u003e\n\u003cli\u003eAttacker successfully guesses the correct answer due to a lack of rate limiting.\u003c/li\u003e\n\u003cli\u003eApplication issues a recovery JWT to the attacker.\u003c/li\u003e\n\u003cli\u003eAttacker uses the recovery JWT to reset the victim's account password via the password reset functionality.\u003c/li\u003e\n\u003cli\u003eAttacker logs into the target account via the connect endpoint, achieving full account takeover.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full account takeover for any account that has not enabled TOTP. This allows unauthorized access to sensitive user data and account functions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade SOGo to version 5.12.13 or later immediately. For environments where patching cannot occur immediately, monitor web server logs for anomalous volumes of POST requests targeting the passwordRecoveryCheck endpoint from single source IPs.\u003c/p\u003e\n","date_modified":"2026-11-12T16:50:45Z","date_published":"2026-11-12T16:50:45Z","id":"https://feed.craftedsignal.io/briefs/2026-11-sogo-auth-bypass-cve-2026-127111/","summary":"SOGo versions prior to 5.12.13 are vulnerable to improper restriction of authentication attempts, enabling unauthenticated attackers to perform brute-force attacks against security questions and achieve full account takeover.","title":"SOGo: Improper authentication restriction in password recovery (CVE-2026-127111)","url":"https://feed.craftedsignal.io/briefs/2026-11-sogo-auth-bypass-cve-2026-127111/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:sogo:sogo:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}