External risk intelligence

Listmonk Authentication Bypass via Password Reset Flow

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-128333

listmonk is a self-hosted newsletter and mailing list manager, which is a web-based application designed to be accessible for administrative management. Such services are commonly deployed as internet-facing web applications to facilitate user management and campaign distribution, making the administrative interface, including the password reset functionality, typically reachable from the internet.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in listmonk software versions prior to 7.0.0-beta.2, specifically affecting the password reset process. The issue allows an attacker to bypass multi-factor authentication and gain full administrative access, including Super Admin privileges, if they can intercept password reset emails. While the exploit requires specific conditions, the potential for unauthorized administrative control underscores the importance of confirming relevance and exposure.

Unauthenticated admin access via password reset.
Critical for preventing unauthorized administrative takeover.
Confirm exposure and validate relevant systems.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication by exploiting a vulnerability in the password reset function. If an attacker can access the victim's password reset email, they can then complete the reset process. This allows the attacker to obtain a fully authenticated session, including Super Admin privileges, without needing a Time-based One-Time Password (TOTP) code.

Attacker must be able to intercept or access reset emails.
Completing the password reset triggers the vulnerability.
Gains full administrative access without second factor.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, attackers who can intercept password reset emails could bypass two-factor authentication to gain full administrative access to the system.

System data and user sessions at risk.
Via intercepted password reset emails.
Unauthorized administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners are likely responsible for addressing this vulnerability in self-hosted listmonk instances, as they manage the application's lifecycle and user access. The first step is to identify all deployments, confirm their reachability and criticality, and then assign an accountable owner to plan remediation.

Application owners should own the issue.
Verify application reachability and criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is listmonk?

Listmonk is a self-hosted newsletter and mailing list manager. It functions as a web-based application that administrators use to manage subscribers, organize contact lists, and distribute email campaigns. Because it handles communication workflows, it is frequently hosted as an accessible web service to support administrative tasks and campaign management.

What does CVE-2026-128333 mean for security?

This vulnerability is classified as CWE-304, which involves missing functionality in an authentication process. In listmonk, the password reset mechanism contains a flaw that fails to verify the second factor, specifically the Time-based One-Time Password (TOTP) code. This allows an attacker to bypass the multi-factor authentication check entirely after resetting a password.

How can an attacker trigger this vulnerability?

An attacker must be able to intercept or access the victim's password reset email to initiate the process. Simply triggering a password reset request is not enough; the attacker must complete the reset flow by using the information from the email. If they successfully complete this sequence, the application grants them a fully authenticated session, including Super Admin privileges, without requiring the TOTP code.

Is my listmonk instance at risk?

Halo Surface Signal indicates that listmonk is typically deployed as an internet-facing web application to facilitate remote management and campaign distribution. Because the administrative interface, including the password reset functionality, is often reachable from the internet, instances should be considered potentially exposed unless specific network controls restrict access.

What should I do if I run listmonk?

Application owners should first locate all active deployments of the software. Once identified, verify whether the instances are reachable from the network and determine their criticality to your operations. Assign an owner to the identified systems to oversee the planning and execution of security updates, as the goal is to move to a patched version that resolves this reset flow issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.