CVE-2026-107145medium6.3
Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator
Impact
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.
Source excerpt · CERT-PLAffected packages
This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
alexandregz · twofactor_gauthenticator
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 0 to before 4640889 | affected |
Original source description
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.
This issue was fixed in commit 4640889.