Live › vulnerability › CVE-2026-107145
Go to dashboardThe twofactor_gauthenticator plugin for Roundcube does not rate-limit attempts at the second-factor code. An attacker who already has a user's password can try arbitrary 6-digit codes until one works and gets into the mailbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 10:31 UTC. All times on this page are UTC.
Roundcube installations that use the twofactor_gauthenticator plugin for TOTP two-factor login. The flaw only matters when an attacker already knows the user's password, since the second factor is the step being attacked. Installations without this plugin, or without two-factor enabled, are not affected.
No product ranges from the sources yet.
twofactor_gauthenticator plugin is installed in the Roundcube plugins/ directory or the config/config.inc.php plugin list4640889, which the sources do not map to a release number: unknowntwofactor_gauthenticator plugin to a build that includes commit 4640889; the release version is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.
This issue was fixed in commit 4640889.
This page as .md · .json · in your agent: get_signal("CVE-2026-107145")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.