---
id: CVE-2026-107147
title: Authentication bypass by spoofing in twofactor_gauthenticator
summary: "The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For\_headers, an attacker\_who obtains user's pa…"
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-290
vendor: alexandregz
product: twofactor_gauthenticator
affected:
  - twofactor_gauthenticator < 4640889
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T09:36:01.938Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107147'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2026-107145'
  - url: >-
      https://github.com/alexandregz/twofactor_gauthenticator/blob/master/CHANGES-2FA-SECURITY.en.md
tags:
  - cve.org
epss: 0.00478
epssPercentile: 0.41046
ingestedAt: '2026-10-27T16:11:59.250Z'
---

## Overview

The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed.




This issue was fixed in commit 4640889.

## Affected

- `twofactor_gauthenticator < 4640889`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.