CVE-2026-33550

Low

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20…

mitre·CWE-308·Published 2026-03-22

CVSS

2.6

EPSS

0.00

KEV

Exploits

cve.orgen

147 chars

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).

NVDen

147 chars

SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length (only 12 digits instead of the 20 recommended).

SOGo anterior a 5.12.5 no renueva la OTP si un usuario la desactiva/activa, y tiene una longitud demasiado corta (solo 12 dígitos en lugar de los 20 recomendados).

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	NVD	2.6	1.2	1.4	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
3.1	Primary	cve.org	2.0	—	—	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
3.1	Secondary	NVD	2.0	0.5	1.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N