Vulnerabilities

TI-2026-81071 CVE-2026-107147 · GHSA-f37x-h4hh-7q49

Authentication bypass by spoofing in twofactor_gauthenticator

LOW 28

The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00392 Published 2026-10-27 Fixed CWE-290

TI-2026-81070 CVE-2026-107146 · GHSA-v777-5g8j-qgq8

LOW 28

The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00346 Published 2026-10-27 Fixed CWE-613

TI-2026-81069 CVE-2026-107145 · GHSA-j947-85xj-mvc2

LOW 28

The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00301 Published 2026-10-27 Fixed CWE-307