---
id: CVE-2026-107146
title: Insufficient session expiration in twofactor_gauthenticator
summary: >-
  The twofactor_gauthenticator plugin for Roundcube is vulnerable to session
  persistence after failed 2FA verification. Due to the lack of server-side
  session destruction, an attacker can ignore the logout redirect and keep the
  session ali…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-613
vendor: alexandregz
product: twofactor_gauthenticator
affected:
  - twofactor_gauthenticator < 4640889
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T09:35:21.367Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107146'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2026-107145'
  - url: >-
      https://github.com/alexandregz/twofactor_gauthenticator/blob/master/CHANGES-2FA-SECURITY.en.md
tags:
  - cve.org
epss: 0.00346
epssPercentile: 0.27954
ingestedAt: '2026-10-27T16:11:59.250Z'
---

## Overview

The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code.




This issue was fixed in commit 4640889.

## Affected

- `twofactor_gauthenticator < 4640889`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.