CVE-2026-107147: Authentication bypass by spoofing in twofactor_gauthenticator
The twofactorgauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed.
This issue was fixed in commit 4640889.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
twofactor_gauthenticatorto a version that resolves this vulnerability.Patch 4640889
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Deployments that use the plugin's IP-based allowlist or whitelist behavior for second-factor bypass are exposed if they accept unvalidated Client-IP or X-Forwarded-For headers. An attacker must also have obtained a valid user's password.
What does an attacker need to do to bypass the second factor?
The attacker needs valid user credentials and must send a spoofed Client-IP or X-Forwarded-For value matching a whitelisted IP address. This causes the plugin to treat the login as coming from a trusted address and bypass 2FA.
How can I determine whether our deployment is affected?
Check whether the installed plugin includes the fix from commit 4640889. Also review whether the plugin is configured to bypass 2FA for whitelisted IP addresses and whether Client-IP or X-Forwarded-For headers can reach it without validation.
What can be done if the fix cannot be applied immediately?
Disable IP-based 2FA bypass or remove whitelisted addresses so that a client-address header cannot be used to skip the second factor. Restrict or validate Client-IP and X-Forwarded-For handling before those headers reach the plugin.