CVE-2026-33550

Katalog CVE

CVSS 2.6 · Low EPSS 0,21%

Kerentanan Use of Single-factor Authentication pada alinto sogo. Skor CVSS 3.1 2.6 (Low) menurut NVD.

Deskripsi (NVD)

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).

Rincian

Terbit di NVD

22 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

2.6 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-308: Use of Single-factor Authentication

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Alinto/sogo/commit/83d4c522f87cfde0ba543837d9b24c3479083ec2 patch
• https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.5 release notes