CVE-2026-107145

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...

CVE-2026-107146

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...

CVE-2026-107147

The twofactorgauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the...

CVE-2026-107147

The twofactor_gauthenticator plugin for Roundcube is vulnerable to a 2FA authentication bypass due to a lack of validation for Client-IP and X-Forwarded-For headers. An attacker who possesses a user's password can spoof a whitelisted IP address to bypass the second factor. This issue was resolved...

CVE-2026-107147 Authentication bypass by spoofing in twofactor_gauthenticator

The twofactorgauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the...

EUVD-2026-110649

The twofactorgauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the...

CVE-2026-107146

The twofactor_gauthenticator plugin for Roundcube is vulnerable to insufficient session expiration (CWE-613). The root cause is a lack of server-side session destruction following a failed two-factor authentication (2FA) verification. Consequently, an attacker who possesses a user's password can ...

CVE-2026-107146 Insufficient session expiration in twofactor_gauthenticator

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...

EUVD-2026-110648

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to...

CVE-2026-107145

The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code due to a lack of rate-limiting in the 2FA code check mechanism (CWE-307). An attacker who obtains a user's password can submit arbitrary 6-digit codes to bypass the second factor and gain un...

CVE-2026-107145 Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...

EUVD-2026-110647

The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This...