CVE-2026-107146

Insufficient session expiration in twofactor_gauthenticator

alexandregz twofactor_gauthenticator

Open in Threatline Record JSON

CVSS

6.3Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in4640889Fixed versionCVE List

Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

4640889twofactor_gauthenticatorCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-107146 The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker Telegram: CVE Notify, 27 Oct 2026

Description

The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code.

This issue was fixed in commit 4640889.

Text from CVE List

Affected versions 1

twofactor_gauthenticatoraffected: all versions before 4640889CVE List