CVE-2026-107146

MediumCVSS 6.3/10Last modified Nov 4, 2026

Description

The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code.

This issue was fixed in commit 4640889.

Metrics

CVSS 4.0 6.3/10

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-613

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
alexandregz	twofactor_gauthenticator	< 4640889

References

Timeline

Published: Oct 27, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1071476.3The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the l CVE-2026-107155.1Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authentic CVE-2026-1071515.9Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callb CVE-2026-1071527.1An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any clie CVE-2026-1071537.0Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physi CVE-2026-1071548.8A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially e CVE-2026-1071558.8A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could p CVE-2026-1071572.0Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application an CVE-2026-1071585.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that CVE-2026-1071596.5MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local CVE-2026-107167.5Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGI CVE-2026-1071605.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain