twofactor_gauthenticator vulnerabilities
CVEs whose affected-version data names the twofactor_gauthenticator package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-107147Medium· 6.3Authentication bypass by spoofing in twofactor_gauthenticator
The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's pa…
CVE-2026-107146Medium· 6.3Insufficient session expiration in twofactor_gauthenticator
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session ali…
CVE-2026-107145Medium· 6.3Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second…