Two-factor authentication is supposed to be the thing that saves you after a password leaks. In one widely used add-on for Roundcube webmail, it was not doing that job. CERT Polska disclosed three vulnerabilities on October 27 in twofactor_gauthenticator, a third-party plugin that adds one-time code logins to Roundcube, and each one gives an attacker who already has a user's password a way past the second factor.
The plugin is maintained by the developer alexandregz. All versions before commit 4640889 are affected, and that commit fixes all three issues. The flaws were reported by Marek Figielski of Vanilla.pl, and CERT Polska coordinated the disclosure. No CVSS scores were published with the advisory.
Three different routes around the same lock
All three bugs share a precondition: the attacker must already know the victim's password. That is a real limit, but phished and reused webmail credentials are common, and blocking exactly that scenario is the reason organisations deploy two-factor login in the first place.
- CVE-2026-107145, no limit on guesses. The plugin does not rate-limit attempts at the six-digit code, so an attacker can keep submitting codes, which CERT Polska says can result in a second-factor bypass and unauthorised access.
- CVE-2026-107146, sessions that survive a failed check. After a failed 2FA verification the plugin does not destroy the session on the server. An attacker can ignore the logout redirect and keep the session alive, which CERT Polska notes could, for example, help brute-force the code.
- CVE-2026-107147, trusting spoofable headers. The plugin does not validate the Client-IP and X-Forwarded-For headers. An attacker can claim to come from a whitelisted IP address and have the second factor skipped entirely.
CERT Polska classifies them as improper restriction of excessive authentication attempts (CWE-307), insufficient session expiration (CWE-613) and authentication bypass by spoofing (CWE-290). The first two work together: a session that is never torn down makes unlimited guessing easier.
Update to commit 4640889 or later
Administrators running twofactor_gauthenticator should update the plugin to a build that includes commit 4640889. Until that is done, the header issue deserves particular attention: any deployment that uses the plugin's IP whitelist to exempt trusted networks from 2FA is exposed to the spoofing bug, so review whether that feature is in use. Logs showing repeated failed code entries for a single account are worth investigating as a sign that someone already holds that user's password.
Roundcube itself is not the vulnerable component here; for flaws in the webmail core, see our earlier coverage of Roundcube's 12-flaw patch release. CERT Polska, Poland's national CERT (more on the country's cyber profile at /country/PL), has become a steady source of these coordinated disclosures for open-source software.
The lesson is a plain one. A second factor is only as strong as the code that enforces it, and a plugin that counts no guesses and trusts whatever IP a client claims has quietly turned two factors back into one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.