CVE-2026-107146
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive.
Risk Assessment
An attacker who obtains the user's password could use the persisted session to brute force the second-factor code or maintain unauthorized access.
Recommendation
Update the plugin to a version containing the fix from commit 4640889, which ensures server-side session destruction after failed 2FA verification.
Other vulnerabilities in twofactor_gauthenticator
See all- CVE-2026-107147Medium
The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2FA authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains the user's password can spoof a whitelisted IP address and bypass the second factor.
- CVE-2026-107145Medium
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains the user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access.
Original NVD description (English source)
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code. This issue was fixed in commit 4640889.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS