CVE-2026-107147

Authentication bypass by spoofing in twofactor_gauthenticator

alexandregz twofactor_gauthenticator

Open in Threatline Record JSON

CVSS

6.3Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in4640889Fixed versionCVE List

Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

4640889twofactor_gauthenticatorCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-107147 The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-FTelegram: CVE Notify, 27 Oct 2026

Description

The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed.

This issue was fixed in commit 4640889.

Text from CVE List

Affected versions 1

twofactor_gauthenticatoraffected: all versions before 4640889CVE List