EUVD-2026-125044

listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin...

CVE-2026-128333

The listmonk application, versions 6.0.0 before 7.0.0-beta.2 , contains an authentication bypass vulnerability in the doResetPassword function. The root cause is a missing critical step in the authentication flow where TOTP verification is skipped following a password reset. An attacker capable o...