CVE-2026-33550 PUBLISHED

Assigner: mitre
Reserved: 22.03.2026 Published: 22.03.2026 Updated: 22.03.2026

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS Score: 2

Product Status

Vendor Alinto
Product SOGo
Versions Default: unaffected
  • affected from 0 to 5.12.5 (excl.)

References

Problem Types

  • CWE-308 Use of Single-factor Authentication CWE