---
id: CVE-2026-107145
title: Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator
summary: >-
  The twofactor_gauthenticator plugin for Roundcube is vulnerable to
  brute-forcing of the second-factor code. Due to the lack of rate limiting, an
  attacker who obtains user's password can submit arbitrary 6-digit codes,
  resulting in second…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-307
vendor: alexandregz
product: twofactor_gauthenticator
affected:
  - twofactor_gauthenticator < 4640889
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T09:34:36.692Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107145'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2026-107145'
  - url: >-
      https://github.com/alexandregz/twofactor_gauthenticator/blob/master/CHANGES-2FA-SECURITY.en.md
tags:
  - cve.org
epss: 0.00367
epssPercentile: 0.30356
ingestedAt: '2026-10-27T16:11:59.249Z'
---

## Overview

The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.




This issue was fixed in commit 4640889.

## Affected

- `twofactor_gauthenticator < 4640889`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.