Skip to content
OpenAdvisories

Product · knadh

listmonk

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.4
    CVE-2026-128332

    listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa

    Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /a…

    knadh listmonk
  • High 7.1
    CVE-2026-34828 Public exploit

    listmonk: Active sessions remain valid after password reset and password change

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes…

    knadh listmonk github.com/knadh/listmonk Go
  • High 8.6
    CVE-2025-58430

    listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, re…

    knadh listmonk github.com/knadh/listmonk Go