UBUNTU-CVE-2026-107147: Medium severity ubuntu/roundcube vulnerability

Published Oct 27, 2026

Updated

The twofactorgauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed. This issue was fixed in commit 4640889.

Affected Software

7 affected components

ubuntu/roundcube*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Roundcube twofactor_gauthenticator plugin to a version that resolves this vulnerability.
Patch 4640889

Event History

Oct 27, 2026

CVE Published

via OSV·10:16 AM

Data Sourced

via OSV·10:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this bypass?

Roundcube deployments using the twofactor_gauthenticator plugin are exposed if they rely on IP-address whitelisting for the second-factor flow and accept unvalidated Client-IP or X-Forwarded-For headers.

What does an attacker need to bypass the second factor?

The attacker needs the user's password and must be able to send spoofed Client-IP or X-Forwarded-For values that match a whitelisted IP address. No prior privileges or user interaction are required.

How can I tell whether my deployment is affected?

Check whether the twofactor_gauthenticator plugin is installed and configured with whitelisted IP addresses, and whether it trusts Client-IP or X-Forwarded-For headers without validation. The issue is fixed by commit 4640889.

UBUNTU-CVE-2026-107147: Medium severity ubuntu/roundcube vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this bypass?

What does an attacker need to bypass the second factor?

How can I tell whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this bypass?

What does an attacker need to bypass the second factor?

How can I tell whether my deployment is affected?