Roundcube 2FA plugin flaws let a stolen password skip the second factor

Roundcube 2FA plugin flaws let a stolen password skip the second factor

27 October 2026: Three flaws in twofactor_gauthenticator, a plugin that adds one-time codes to Roundcube webmail, let an attacker who already has a user's password get past the second factor. CERT Polska, Poland's national computer emergency team, coordinated the disclosure and says all versions before commit 4640889 in the plugin's repository are affected. The fix is that commit; there is no numbered release to install.

Not yet independently verified. CERT Polska's advisory gives no CVSS scores and does not say whether the flaws have been exploited. We have not seen a statement or a tagged release from the plugin's maintainer. We will update this when it can be confirmed, and remove this note.

CERT Polska names the vendor as alexandregz, the developer who publishes the plugin; it is not part of the Roundcube project. That matters for patching: Roundcube's own security releases, such as the 1.7.5 and 1.6.20 fixes we covered earlier, do not touch it.

Three ways round the one-time code

CVE-2026-107145 is a missing rate limit. The plugin accepts any number of guesses at the six-digit code, so someone holding the password can keep submitting codes until one works.

CVE-2026-107146 makes that easier. After a failed check the plugin redirects the browser to log out, but it does not destroy the session on the server. An attacker who ignores the redirect keeps a live session and can carry on guessing.

CVE-2026-107147 skips the guessing altogether. The plugin can let users from trusted IP addresses log in without a code, and it reads the client address from the Client-IP and X-Forwarded-For headers without checking them. Anyone with the password can send a header claiming to come from a whitelisted address and the second factor is not asked for.

CERT Polska credits Marek Figielski of Vanilla.pl with the report.

What an administrator should change

Update the plugin to a checkout that includes commit 4640889. Package managers and hosting control panels that bundle Roundcube plugins may lag behind the repository, so check the commit rather than the version string.

If the IP whitelist feature is in use and the plugin cannot be updated at once, switching the whitelist off closes the header bypass. A reverse proxy in front of Roundcube can also strip any Client-IP or X-Forwarded-For header that arrives from outside, which protects other applications that trust those headers too. Rate limiting the login path at the proxy, and alerting on repeated failed code entries for one account, covers the guessing attacks.

All three flaws need the password first, so an unexplained run of failed second-factor attempts on a mailbox is also a sign that the password has leaked and should be reset.

Where this sits in our catalogue

Our email security category lists 11 products and our authentication software category six; none of them is a Roundcube plugin, and we hold no listing for the plugin or its maintainer.

Related on TrustList:

• Entra ID adds passkeys for guest users, on by default
• Norway's security authority raises national cyber risk level to high

Sources

• CERT Polska: Vulnerabilities in twofactor_gauthenticator plugin for Roundcube, 27 October 2026