Threat reportVulnerabilityTL-2026-4525
Roundcube twofactor_gauthenticator plugin 2FA bypass vulnerabilities (CVE-2026-107145, CVE-2026-107146, CVE-2026-107147)
Roundcube twofactor_gauthenticator plugin 2FA bypass (TL-2026-4525) is a medium-severity software vulnerability, first published 2026-10-27. It has no confirmed attribution, affects alexandregz twofactor_gauthenticator (Roundcube plugin), references 3 CVEs (CVE-2026-107145, CVE-2026-107146, CVE-2026-107147), maps to 5 MITRE ATT&CK techniques (T1078, T1110, T1190), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4525
- Threat ID
- TL-2026-4525
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, education, health, finance, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Roundcube twofactor_gauthenticator plugin 2FA bypass
Malware and tooling: PHP
How Roundcube twofactor_gauthenticator plugin 2FA bypass works
CERT Polska disclosed three flaws in the alexandregz twofactor_gauthenticator Roundcube plugin: no rate limiting on second-factor codes (CWE-307), no server-side session destruction after failed 2FA (CWE-613), and 2FA whitelist bypass via spoofed Client-IP / X-Forwarded-For headers (CWE-290). All versions before commit 4640889 are affected.
The twofactor_gauthenticator plugin adds TOTP-based (RFC 6238) two-step verification to Roundcube webmail logins. CERT Polska, following coordinated disclosure by Marek Figielski (Vanilla.pl), published three vulnerabilities on 2026-10-27 that let an attacker who already holds a user's password defeat the second factor.
CVE-2026-107145 (CWE-307, improper restriction of excessive authentication attempts): the plugin applies no rate limiting to second-factor codes, so an attacker with the user's password can submit arbitrary 6-digit codes repeatedly and brute-force the TOTP value.
CVE-2026-107146 (CWE-613, insufficient session expiration): after a failed 2FA verification the plugin does not destroy the session server-side. The client is redirected to logout, but an attacker can ignore the redirect and keep the session alive.
CVE-2026-107147 (CWE-290, authentication bypass by spoofing): the plugin supports an IP whitelist that skips 2FA. Client-IP and X-Forwarded-For request headers are not validated, so an attacker can spoof a whitelisted address and have the second factor bypassed.
The fix is in upstream commit 4640889 (README.md, config.inc.php.dist, twofactor_gauthenticator.php; 317 additions, 19 deletions). It adds persistent per-(IP, username) failure tracking with incremental lockout delays (twofactor_lockout_delays, default 1/2/5/20/60/300/600 seconds; twofactor_lockout counter expiry, default 900 seconds), full server-side session teardown via rcmail::kill_session() with the 30-day remember-me cookie cleared, and a new twofactor_trusted_proxies option (default empty) so the client IP resolves to REMOTE_ADDR and X-Forwarded-For is honored only from configured proxies, parsed right-to-left. The source does not state a CVSS score, in-the-wild exploitation, a public PoC, or network IOCs; the severity is an analyst estimate pending scoring. NVD returned no record for CVE-2026-107145 at time of research.
MITRE ATT&CK techniques used in TL-2026-4525
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
Credential Access
T1110 Brute Force; T1556 Modify Authentication Process
lateral-movement
Lateral Movement
defense-impairment
Affected products and versions in Roundcube twofactor_gauthenticator plugin 2FA bypass
- alexandregz — twofactor_gauthenticator (Roundcube plugin)
Vulnerable versions: All versions before commit 4640889
Fixed in: Commit 4640889 and later
Remediation for Roundcube twofactor_gauthenticator plugin 2FA bypass
Patches
- Upstream fix: alexandregz/twofactor_gauthenticator commit 4640889
Immediate actions
- Update twofactor_gauthenticator to a build that includes upstream commit 4640889
- Review the plugin's IP whitelist and remove entries that are not strictly required
- Review Roundcube and web-server logs for repeated 2FA code submissions and for requests carrying Client-IP or X-Forwarded-For headers from untrusted sources
Workarounds
- Disable the plugin's IP whitelist feature until patched
- After patching, set twofactor_trusted_proxies only to proxies you control; leave it empty when Roundcube is not behind a reverse proxy
- Restrict webmail access at the network layer (VPN or IP allow-list at the proxy)
Longer-term hardening
- Strip or overwrite Client-IP and X-Forwarded-For at the edge proxy so clients cannot inject them
- Rate-limit and alert on repeated failed 2FA verifications per account and source at the reverse proxy or WAF
- Enforce strong unique passwords and monitor for credential stuffing against webmail
CVEs associated with Roundcube twofactor_gauthenticator plugin 2FA bypass
Weaknesses (CWE) in Roundcube twofactor_gauthenticator plugin 2FA bypass
Timeline of Roundcube twofactor_gauthenticator plugin 2FA bypass
- Per the plugin repository, an earlier security issue allowing users to disable 2FA without completing authentication was fixed by requiring valid session tokens from rendered pages.
- Threadlinqs began tracking the threat; NVD returned no record for CVE-2026-107145, and no CVSS score, in-the-wild exploitation or public PoC is stated in the sources.
- NVD API queries for CVE-2026-107145 and CVE-2026-107146 returned totalResults 0; no CVSS score is published, so severity remains an analyst estimate.
- Commit 4640889 (V-3) adds __getClientIP(): REMOTE_ADDR by default, X-Forwarded-For honored only from proxies listed in twofactor_trusted_proxies, and HTTP_CLIENT_IP support removed entirely; V-4 also replaces a dead operator-precedence freshness check with a central __is2FAFresh() helper.
- Commit 4640889 (V-2) makes __exitSession() perform full server-side teardown via rcmail::kill_session(), clearing cookies and the 30-day remember-me cookie, so a failed 2FA no longer leaves a live session.
- Commit 4640889 (V-1) adds a persistent per-(IP, username) failure counter stored as JSON files in the log directory, with escalating lockout delays of 1/2/5/20/60/300/600 seconds (twofactor_lockout_delays) and a 900-second counter expiry (twofactor_lockout).
- The advisory identifies upstream commit 4640889 as the fix: lockout delays, server-side session teardown and twofactor_trusted_proxies (commit message: hardening 2FA auth flow against V-1..V-4 findings).
- CVE-2026-107145 (CWE-307), CVE-2026-107146 (CWE-613) and CVE-2026-107147 (CWE-290) were published for all plugin versions before commit 4640889.
- CERT Polska published the advisory 'Vulnerabilities in twofactor_gauthenticator plugin for Roundcube' following coordinated disclosure by Marek Figielski (Vanilla.pl).
Sources cited for Roundcube twofactor_gauthenticator plugin 2FA bypass
- Vulnerabilities in twofactor_gauthenticator plugin for Roundcube - CERT Polska
- alexandregz/twofactor_gauthenticator - GitHub repository
- Fix commit 4640889 - hardening 2FA auth flow against V-1..V-4 findings
- CERT Polska Coordinated Vulnerability Disclosure policy
- CERT Polska incident reporting
- NVD CVE API query for CVE-2026-107145 (no record at time of research)
Detection coverage for TL-2026-4525
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4525 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.