GCVE - cpe:2.3:a:alexandregz:twofactor_gauthenticator:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:alexandregz:twofactor_gauthenticator:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Alexandregz (`8dbb97e7-6d15-5313-a2f3-56eaf10e16bf`)
Product	Twofactor Gauthenticator (`451d5f21-ba0a-5056-b45c-b7ef8773add8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-107145`	vulnerable	2026-11-03 10:15:59.178232	Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This issue was fixed in commit 4640889. Published: 2026-10-27T09:34:36.692Z Updated: 2026-11-04T14:58:27.010Z Open on db.gcve.eu Reference links https://cert.pl/en/posts/2026/10/CVE-2026-107145 https://github.com/alexandregz/twofactor_gauthenticator/blob/master/CHANGES-2FA-SECURITY.en.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-107147`	vulnerable	2026-11-03 10:15:59.057219	Authentication bypass by spoofing in twofactor_gauthenticator The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed. This issue was fixed in commit 4640889. Published: 2026-10-27T09:36:01.938Z Updated: 2026-11-04T14:58:11.190Z Open on db.gcve.eu Reference links https://cert.pl/en/posts/2026/10/CVE-2026-107145 https://github.com/alexandregz/twofactor_gauthenticator/blob/master/CHANGES-2FA-SECURITY.en.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-107146`	vulnerable	2026-11-03 10:15:58.978533	Insufficient session expiration in twofactor_gauthenticator The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code. This issue was fixed in commit 4640889. Published: 2026-10-27T09:35:21.367Z Updated: 2026-11-04T14:58:18.794Z Open on db.gcve.eu Reference links https://cert.pl/en/posts/2026/10/CVE-2026-107145 https://github.com/alexandregz/twofactor_gauthenticator/blob/master/CHANGES-2FA-SECURITY.en.md	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Twofactor Gauthenticator

Notes

PURL mappings

Vulnerability references

Contribute