CVE-2026-107147
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2FA authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains the user's password can spoof a whitelisted IP address and bypass the second factor.
Risk Assessment
Possession of the password alone is enough to bypass 2FA, significantly weakening mailbox account protection and potentially leading to unauthorized access.
Recommendation
Update the twofactor_gauthenticator plugin to a version containing the fix from commit 4640889 and ensure Client-IP and X-Forwarded-For headers are properly validated.
Other vulnerabilities in twofactor_gauthenticator
See all- CVE-2026-107146Medium
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive.
- CVE-2026-107145Medium
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains the user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access.
Original NVD description (English source)
The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed. This issue was fixed in commit 4640889.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS