CVE-2026-127131

SOGo versions prior to 5.12.13 are vulnerable to a missing rate limiting flaw in the web login TOTP verification process. Because failed TOTP attempts do not increment the failed-login counter and SOGoMaximumFailedLoginCount is not applied, an attacker who already possesses a victim's password ca...

EUVD-2026-124530

SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attackers can send repeated POST requests to /SOGo/connect with...