Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-107147

Authentication bypass by spoofing in twofactor_gauthenticator

The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed. This issue was fixed in commit 4640889.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Alexandregz
Products
Twofactor Gauthenticator
CVE-2026-107146

Insufficient session expiration in twofactor_gauthenticator

The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code. This issue was fixed in commit 4640889.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Alexandregz
Products
Twofactor Gauthenticator
CVE-2026-107145

Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This issue was fixed in commit 4640889.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Alexandregz
Products
Twofactor Gauthenticator