External risk intelligence

Listmonk Two-Factor Authentication Bypass via TOTP Brute-Force.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-128332

Listmonk is a self-hosted newsletter and mailing list manager. Its administrative interface, which includes the affected login endpoint, is commonly deployed as a web-accessible application to allow users to manage campaigns and subscribers remotely. While access can be restricted, the product role as a web application platform frequently places the admin login surface in a position reachable from the internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Listmonk that could allow unauthorized access to two-factor authentication-protected accounts. This issue stems from how the system handles login attempts, specifically by resetting an attempt counter that enables brute-force attacks on time-based one-time password codes. The potential impact involves attackers gaining access to sensitive accounts, including Super Admin, if they possess a valid password.

Two-factor codes can be bypassed.
Confirms password and two-factor code access.
Assess exposure and confirm relevance.

Attack Path

How an attacker could exploit the issue

An attacker could bypass two-factor authentication on Listmonk by repeatedly logging in with a valid password. This action resets a counter that limits incorrect two-factor code attempts, allowing the attacker to guess the correct code and gain unauthorized access to accounts, including administrator privileges.

Requires valid password for entry.
Resets attempt counter on login.
Risks unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker with a valid password could bypass two-factor authentication by repeatedly logging in with different TOTP codes. This could allow unauthorized access to sensitive account information and administrative functions.

Sensitive account data and administrative functions.
Repeatedly guessing TOTP codes after login.
Unauthorized access to the application.

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners and application teams are likely responsible for addressing this vulnerability in Listmonk. The first practical step is to identify all instances of Listmonk, determine their reachability and business criticality, and then locate the accountable owner to plan remediation based on risk.

Identify all Listmonk instances.
Verify reachability and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Listmonk?

Listmonk is a self-hosted, open-source newsletter and mailing list management application. It provides a web-based administrative dashboard used to manage subscriber lists, organize audience data, and execute email campaigns. Because it is designed for remote management of these communication tasks, the application is frequently deployed on servers where the administrative interface is accessible via a web browser.

How does CVE-2026-128332 work?

This vulnerability is classified as CWE-307, which involves improper restriction of excessive authentication attempts. In Listmonk, the mechanism meant to limit incorrect time-based one-time password (TOTP) guesses fails because the attempt counter resets every time a user logs in with a valid password. This flaw allows an attacker who has compromised a user's password to repeatedly guess 2FA codes until they successfully bypass the security layer and gain unauthorized account access.

Does this issue happen if I do not have a valid password?

No. The vulnerability specifically relies on the ability to authenticate with a valid password first. Once that initial password check passes, the system exposes the TOTP entry page. The bug is triggered by submitting incorrect 2FA codes, logging out or re-authenticating to reset the counter, and repeating the process. It is not triggered by brute-forcing the password itself, but rather by exploiting the logic flaw that governs the secondary 2FA code verification process.

Is my Listmonk instance at risk?

If your instance is reachable from the internet, it is at higher risk. Halo Surface Signal indicates that Listmonk's role as a web application platform frequently places the admin login interface in positions where it is accessible to external networks. If your administrative console is internet-facing, attackers can attempt to reach the login endpoint. Instances restricted to internal networks or protected by additional layers like a VPN are naturally less exposed.

What is the first step to address this?

Begin by inventorying all instances of Listmonk running in your environment. Once identified, verify their network reachability and determine which accounts are designated as administrative, especially Super Admin roles. After assessing these factors, locate the technical owner for each instance to coordinate an update to the patched version of the software, thereby closing the gap in your 2FA security controls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.