# Roundcube twofactor_gauthenticator plugin 2FA bypass vulnerabilities (CVE-2026-107145, CVE-2026-107146, CVE-2026-107147)

> CERT Polska disclosed three flaws in the alexandregz twofactor_gauthenticator Roundcube plugin: no rate limiting on second-factor codes (CWE-307), no server-side session destruction after failed 2FA (CWE-613), and 2FA whitelist bypass via spoofed Client-IP / X-Forwarded-For headers (CWE-290). All versions before commit 4640889 are affected.

- **Published:** 2026-10-27T09:46:02Z
- **Last reviewed:** 2026-10-27T09:46:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4525
- **ID:** TL-2026-4525
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-107145, CVE-2026-107146, CVE-2026-107147

## Description

The twofactor_gauthenticator plugin adds TOTP-based (RFC 6238) two-step verification to Roundcube webmail logins. CERT Polska, following coordinated disclosure by Marek Figielski (Vanilla.pl), published three vulnerabilities on 2026-10-27 that let an attacker who already holds a user's password defeat the second factor.

CVE-2026-107145 (CWE-307, improper restriction of excessive authentication attempts): the plugin applies no rate limiting to second-factor codes, so an attacker with the user's password can submit arbitrary 6-digit codes repeatedly and brute-force the TOTP value.

CVE-2026-107146 (CWE-613, insufficient session expiration): after a failed 2FA verification the plugin does not destroy the session server-side. The client is redirected to logout, but an attacker can ignore the redirect and keep the session alive.

CVE-2026-107147 (CWE-290, authentication bypass by spoofing): the plugin supports an IP whitelist that skips 2FA. Client-IP and X-Forwarded-For request headers are not validated, so an attacker can spoof a whitelisted address and have the second factor bypassed.

The fix is in upstream commit 4640889 (README.md, config.inc.php.dist, twofactor_gauthenticator.php; 317 additions, 19 deletions). It adds persistent per-(IP, username) failure tracking with incremental lockout delays (twofactor_lockout_delays, default 1/2/5/20/60/300/600 seconds; twofactor_lockout counter expiry, default 900 seconds), full server-side session teardown via rcmail::kill_session() with the 30-day remember-me cookie cleared, and a new twofactor_trusted_proxies option (default empty) so the client IP resolves to REMOTE_ADDR and X-Forwarded-For is honored only from configured proxies, parsed right-to-left. The source does not state a CVSS score, in-the-wild exploitation, a public PoC, or network IOCs; the severity is an analyst estimate pending scoring. NVD returned no record for CVE-2026-107145 at time of research.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1110 Brute Force
- T1556 Modify Authentication Process
- T1556 Modify Authentication Process
- T1550.004 Web Session Cookie
- T1550.004 Web Session Cookie
- T1078 Valid Accounts

## Sources

- [Vulnerabilities in twofactor_gauthenticator plugin for Roundcube - CERT Polska](https://cert.pl/en/posts/2026/10/CVE-2026-107145/)
- [alexandregz/twofactor_gauthenticator - GitHub repository](https://github.com/alexandregz/twofactor_gauthenticator)
- [Fix commit 4640889 - hardening 2FA auth flow against V-1..V-4 findings](https://github.com/alexandregz/twofactor_gauthenticator/commit/4640889)
- [CERT Polska Coordinated Vulnerability Disclosure policy](https://cert.pl/en/cvd/)
- [CERT Polska incident reporting](https://incydent.cert.pl/)
- [NVD CVE API query for CVE-2026-107145 (no record at time of research)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-107145)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4525