EUVD-2026-14269
GHSA-9x6p-jf26-xmx7
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Multi-factor authentication
|
| Impact | This vulnerability presents minimal real-world risk despite CWE-308 classification. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) reveals critical limiting factors: attack vector is network but requires high privileges (PR:H), attack complexity is high (AC:H), requires user interaction (UI:R), and impact is limited to integrity (I:L) with no confidentiality or availability impact. The threat model requires an administrator or high-privilege user to both enable/disable MFA and interact with the system, making this a low-priority vulnerability. No EPSS score, KEV status, or active exploitation data is available, further supporting a low-urgency assessment. SSVC decision would likely classify this as defer or out-of-scope for most organizations. |
| Exploit ScenarioDerived | An administrator with high privileges could intentionally disable and re-enable OTP authentication for their own account to reuse a previously captured OTP token, effectively bypassing the intended MFA requirement during that window. Alternatively, if an attacker gains administrator-level credentials through phishing or credential compromise, the weak 12-digit OTP could be brute-forced (40-bit keyspace) more efficiently than the recommended 20-digit OTP, allowing account takeover. The requirement for high privileges and user interaction makes this a low-probability attack in most environments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 22, 2026
SOGo versions prior to 5.12.5 contain two related one-time password (OTP) implementation weaknesses: the OTP is not regenerated when users disable and re-enable two-factor authentication, and the OTP length is only 12 digits instead of the cryptographically recommended 20 digits. While the CVSS score is low (2.0) due to high attack complexity and privileges required, this vulnerability could allow authenticated administrators or high-privilege users with social engineering capability to bypass or weaken OTP protections. No known active exploitation or public proof-of-concept exists, but the issue has been acknowledged and patched by the vendor.
RemediationAI
Upgrade SOGo to version 5.12.5 or later to resolve both the OTP regeneration and entropy issues. Organizations unable to immediately patch should implement compensating controls by enforcing strong password policies in addition to OTP authentication, disabling MFA toggle functionality for non-administrative users, and logging all MFA configuration changes for audit purposes. Additionally, restrict administrative access to trusted networks and enable alerting for any MFA modifications. The vendor advisory and patch are available at https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.5.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SOGo is an open-source groupware suite (affected via CPE cpe:2.3:a:alinto:sogo:*:*:*:*:*:*:*:*) that provides calendar, contact, and email services with integrated authentication and multi-factor authentication features. The vulnerability relates to CWE-308 (Use of Single-factor Authentication), which occurs when OTP regeneration logic fails to create a new secret when MFA is toggled, and the entropy of the OTP is insufficient (12 digits ≈ 40 bits of entropy vs. 20 digits ≈ 66 bits). This allows both token reuse attacks if the original token is compromised and reduced brute-force resistance due to shorter keyspace.
Know when Sogo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).
Executive ViewAI
CVE-2026-33550 is a low-severity vulnerability (CVSS 2.0). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in SOGo Authentication and XSS Vulnerabilities
View all 2Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0. Rated high severity (CVSS 8.8), this vulnerability
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.
alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter. Rated medium severity (CVSS
Password-reset token interception in SOGo before 5.12.11 lets unauthenticated remote attackers redirect account-recovery
Incomplete blacklist in SOGo before 2.3.12 and 3.x before 3.1.1 allows remote authenticated users to obtain sensitive in
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receiv
SQL injection in SOGo versions prior to 5.12.7 allows authenticated users to inject arbitrary SQL when changing their pa
SQL injection in Alinto SOGo versions prior to 5.12.7 allows authenticated remote attackers to manipulate database queri
Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number o
Multiple cross-site scripting (XSS) vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to i
Multiple cross-site scripting (XSS) vulnerabilities in the View Raw Source page in the Web Calendar in SOGo before 3.1.3
Same weakness CWE-308 – Use of Single-factor Authentication
View allSame technique Information Disclosure
View allVendor StatusVendor
Debian
Bug #1131606| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 5.0.1-4+deb11u1 | - |
| bullseye (security) | vulnerable | 5.0.1-4+deb11u3 | - |
| bookworm | vulnerable | 5.8.0-2+deb12u2 | - |
| trixie | vulnerable | 5.12.1-3+deb13u1 | - |
| forky, sid | vulnerable | 5.12.4-1.2 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB