Live › vulnerability › CVE-2026-107146
Go to dashboardThe twofactor_gauthenticator plugin for Roundcube does not destroy the server-side session after a failed second-factor check, so the session stays valid. An attacker who already has the user's password can keep that session and keep guessing the second-factor code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 10:31 UTC. All times on this page are UTC.
Roundcube installations that use the twofactor_gauthenticator plugin for two-factor login are exposed. Sites without this plugin, or that do not enable two-factor authentication through it, can skip it.
No product ranges from the sources yet.
config/config.inc.php under plugins4640889; the sources do not name a fixed release version4640889; the sources do not name the versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code.
This issue was fixed in commit 4640889.
This page as .md · .json · in your agent: get_signal("CVE-2026-107146")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.