{"id":"CVE-2026-107145","kind":"vulnerability","aliases":["CVE-2026-107145"],"related":[],"title":"Roundcube 2FA plugin lacks rate limiting, allowing second-factor brute force","description":"The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.\n\n\n\n\nThis issue was fixed in commit 4640889.","summary":"The twofactor_gauthenticator plugin for Roundcube does not rate-limit attempts at the second-factor code. An attacker who already has a user's password can try arbitrary 6-digit codes until one works and gets into the mailbox.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","mail-server","package","roundcube","self-hosted"],"not_affected_if":["2fa-not-enabled","plugin-not-installed"],"how_to_check":"- Check whether the `twofactor_gauthenticator` plugin is installed in the Roundcube `plugins/` directory or the `config/config.inc.php` plugin list\n- Check the installed plugin version against the fixed commit `4640889`, which the sources do not map to a release number: unknown","fix":"- Update the `twofactor_gauthenticator` plugin to a build that includes commit `4640889`; the release version is unknown\n- Until updated, disable the plugin or enforce a stronger second factor for Roundcube logins","status":"open","published_at":"2026-10-27T10:16:54+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","triaged_at":"2026-10-27T10:32:00+00:00","updated_at":"2026-10-27T10:32:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T10:32:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update the `twofactor_gauthenticator` plugin to a build that includes commit `4640889`; the release version is unknown\n- Until updated, disable the plugin or enforce a stronger second factor for Roundcube logins","reach":"internet","title":"Roundcube 2FA plugin lacks rate limiting, allowing second-factor brute force","impact":"high","summary":"The twofactor_gauthenticator plugin for Roundcube does not rate-limit attempts at the second-factor code. An attacker who already has a user's password can try arbitrary 6-digit codes until one works and gets into the mailbox.","category":"package","nicknames":[],"who_cares":["roundcube","self-hosted","email","mail-server"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker bypasses second factor and reads the victim's mailbox","analyst_note":"Find the release version that contains commit 4640889 and confirm whether the fix adds rate limiting or lockout, at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-107145 and the plugin's upstream repository.","how_to_check":"- Check whether the `twofactor_gauthenticator` plugin is installed in the Roundcube `plugins/` directory or the `config/config.inc.php` plugin list\n- Check the installed plugin version against the fixed commit `4640889`, which the sources do not map to a release number: unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed","2fa-not-enabled"],"who_is_affected":"Roundcube installations that use the twofactor_gauthenticator plugin for TOTP two-factor login. The flaw only matters when an attacker already knows the user's password, since the second factor is the step being attacked. Installations without this plugin, or without two-factor enabled, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":3341,"output_tokens":670,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107145':15A,18A '-2026':14A,17A '2fa':2A '4640889':125C '6':58B,104C 'access':115C 'allow':7A 'alreadi':49B 'arbitrari':57B,103C 'attack':47B,95C 'attempt':39B 'brute':11A,79C 'brute-forc':78C 'bypass':112C 'code':45B,60B,86C,106C 'commit':124C 'cve':13A,16A 'digit':59B,105C 'due':87C 'email':19B 'factor':10A,44B,85C,111C 'fix':122C 'forc':12A,80C 'gauthent':30B,71C 'get':65B 'host':27B 'issu':120C 'lack':4A,90C 'limit':6A,38B,93C 'mail':21B 'mail-serv':20B 'mailbox':68B 'obtain':97C 'one':62B 'packag':23B 'password':54B,100C 'plugin':3A,31B,72C 'rate':5A,37B,92C 'rate-limit':36B 'result':107C 'roundcub':1A,24B,33B,74C 'second':9A,43B,84C,110C 'second-factor':8A,42B,83C,109C 'self':26B 'self-host':25B 'server':22B 'submit':102C 'system':118C 'tri':56B 'twofactor':29B,70C 'unauthor':114C 'user':52B,98C 'vulner':76C 'work':63B","nicknames":[],"mitigations":[],"who_affected":"Roundcube installations that use the twofactor_gauthenticator plugin for TOTP two-factor login. The flaw only matters when an attacker already knows the user's password, since the second factor is the step being attacked. Installations without this plugin, or without two-factor enabled, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T10:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107145","severity":null,"published_at":"2026-10-27T10:16:54+00:00","modified_at":"2026-10-27T10:16:54+00:00","first_seen_at":"2026-10-27T10:31:02+00:00","fetched_at":"2026-10-27T10:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}