CVE-2026-107145
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains the user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access.
Risk Assessment
The absence of attempt limits enables effective guessing of the 2FA code, which combined with a stolen password leads to full unauthorized account access.
Recommendation
Update the plugin to a version containing the fix from commit 4640889 that introduces rate limiting for second-factor code verification.
Other vulnerabilities in twofactor_gauthenticator
See all- CVE-2026-107147Medium
The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2FA authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains the user's password can spoof a whitelisted IP address and bypass the second factor.
- CVE-2026-107146Medium
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive.
Original NVD description (English source)
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This issue was fixed in commit 4640889.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS