Vulnerabilities in twofactor_gauthenticator plugin for Roundcube

CERT Polska has received a report about vulnerabilities in twofactor_gauthenticator plugin for Roundcube and participated in coordination of their disclosure.

The vulnerabilityCVE-2026-107145: The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes multiple times, which can result in second-factor bypass and unauthorized access to the system.

The vulnerabilityCVE-2026-107146: The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code.

The vulnerabilityCVE-2026-107147: The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed.

These issues were fixed in commit 4640889.

We thank Marek Figielski (Vanilla.pl) for the responsible vulnerability report.