CVE-2026-107146: Insufficient session expiration in twofactor_gauthenticator
The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code.
This issue was fixed in commit 4640889.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube twofactor_gauthenticator pluginto a version that resolves this vulnerability.Patch 4640889
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must obtain the user's password. The persistent session can then allow them to continue attempting to brute-force the second-factor code.
What behavior makes the session remain usable?
After a failed 2FA verification, the plugin does not destroy the session on the server side. An attacker can ignore the logout redirect and retain the session.
How can this issue be remediated?
Update to a version of the plugin that includes the fix from commit 4640889.