CVE-2026-33550

LOW

SOGo <5.12.5 - OTP Weakness

Title source: llm

Description

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).

References (2)

Scores

CVSS v3 2.0
EPSS 0.0003
EPSS Percentile 8.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

Details

CWE
CWE-308
Status published
Products (2)
Alinto/SOGo < 5.12.5
alinto/sogo < 5.12.5
Published Mar 22, 2026
Tracked Since Mar 22, 2026