UBUNTU-CVE-2026-107146: Medium severity ubuntu/roundcube vulnerability

Published Oct 27, 2026

Updated

The twofactorgauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code. This issue was fixed in commit 4640889.

Affected Software

7 affected components

ubuntu/roundcube*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Roundcube twofactor_gauthenticator plugin to a version that resolves this vulnerability.
Patch 4640889

Event History

Oct 27, 2026

CVE Published

via OSV·10:16 AM

Data Sourced

via OSV·10:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need before they can take advantage of this issue?

The attacker needs to obtain the user's password. They can then keep a session alive after a failed second-factor verification attempt and may use it to brute-force the second-factor code.

Can a failed two-factor verification be relied upon to terminate the login session?

No. The affected plugin does not destroy the session server-side after failed 2FA verification, so ignoring the logout redirect can leave the session active.

What fix is identified for this issue?

The issue was fixed in commit 4640889.

UBUNTU-CVE-2026-107146: Medium severity ubuntu/roundcube vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need before they can take advantage of this issue?

Can a failed two-factor verification be relied upon to terminate the login session?

What fix is identified for this issue?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need before they can take advantage of this issue?

Can a failed two-factor verification be relied upon to terminate the login session?

What fix is identified for this issue?