CVE-2026-107145: Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator
The twofactorgauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.
This issue was fixed in commit 4640889.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
twofactor_gauthenticatorto a version that resolves this vulnerability.Patch 4640889
Event History
Frequently Asked Questions
What does an attacker need before they can bypass the second factor?
The attacker must first obtain the user's password. They can then repeatedly submit arbitrary 6-digit second-factor codes until one succeeds because the code-check mechanism lacks rate limiting.
Which deployments are exposed?
Roundcube installations using the twofactor_gauthenticator plugin are affected if they use a version that does not include commit 4640889.
What can be done if the fix cannot be applied immediately?
The provided information identifies no documented workaround. Prioritize applying the fix in commit 4640889 and treat passwords for accounts using the affected plugin as particularly important to protect, since password compromise enables brute-forcing of the second factor.