Advisories

Vulnerabilities in twofactor_gauthenticator plugin for Roundcube

CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-107145 to CVE-2026-107147) found in twofactor_gauthenticator plugin for Roundcube.

Read at CERT Polska

Vendor

Roundcube

Product

Roundcube

Exposure class

Email

• CERT Polska (cert.pl)
• CVE-2026-107145 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-107147 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 22
   CVE NVD 5d ago

   The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers.

   CVSS 6.3 Fix available CVE-2026-107147 Alexandregz
2. 22
   CVE NVD 5d ago

   The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code.

   CVSS 6.3 Fix available CVE-2026-107145 Alexandregz