CVE-2026-107145mediumCWE-307

CVE-2026-107145: medium-severity vulnerability in alexandregz twofactor_gauthenticator

Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

Published

Follow this CVE+ Monitor twofactor gauthenticator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.3%
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This issue was fixed in commit 4640889.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
alexandregz · twofactor_gauthenticator
Related CVEs — alexandregz twofactor_gauthenticator

In the same product, most dangerous first.

CVE-2026-107147MEDIUMAuthentication bypass by spoofing in twofactor_gauthenticatorEPSS 0.4%CVE-2026-107146MEDIUMInsufficient session expiration in twofactor_gauthenticatorEPSS 0.3%