CVE-2026-107146
Received Received - Intake

Session Persistence Flaw in Roundcube Twofactor Gauthenticator

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: CERT.PL

Description
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code. This issue was fixed in commit 4640889.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-107146
EUVD
EUVD-2026-110648

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
alexandregz twofactor_gauthenticator 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-107146 is a vulnerability in the twofactor_gauthenticator plugin for Roundcube where server-side sessions are not properly terminated after failed two-factor authentication attempts. This allows an attacker with a user's password to bypass logout redirects and keep the session active indefinitely, enabling brute-force attacks on the 2FA code.

Detection Guidance

Check Roundcube logs for repeated failed 2FA attempts from the same IP or user. Look for sessions that remain active after logout redirects or failed 2FA attempts. Verify if sessions persist without proper server-side destruction.

Impact Analysis

If an attacker obtains your password, they can repeatedly attempt to brute-force the 2FA code without the session timing out. This could lead to unauthorized access to your Roundcube account and potentially sensitive data stored within it.

Mitigation Strategies

Update the twofactor_gauthenticator plugin to version 2.0.0 or apply commit 4640889. Ensure server-side session destruction is enforced after failed 2FA attempts. Implement rate limiting for TOTP and recovery code attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart