CVE-2026-107145

Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

alexandregz twofactor_gauthenticator

Open in Threatline Record JSON

CVSS

6.3Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in4640889Fixed versionCVE List

Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

4640889twofactor_gauthenticatorCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-107145 The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password Telegram: CVE Notify, 27 Oct 2026

Description

The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system.

This issue was fixed in commit 4640889.

Text from CVE List

Affected versions 1

twofactor_gauthenticatoraffected: all versions before 4640889CVE List