EUVD-2026-125044

listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP verification after a password reset. Attackers who can complete a reset, such as by reading the victim's reset email, obtain fully authenticated sessions including Super Admin...

CVE-2026-128333

The listmonk application, versions 6.0.0 before 7.0.0-beta.2 , contains an authentication bypass vulnerability in the doResetPassword function. The root cause is a missing critical step in the authentication flow where TOTP verification is skipped following a password reset. An attacker capable o...

PT-2026-146547

Name of the Vulnerable Software and Affected Versions listmonk versions 6.0.0 through 7.0.0-beta.1 Description An authentication bypass exists in the doResetPassword function. The issue allows the TOTP Time-based One-Time Password verification step to be skipped following a password reset. An...