Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107145— Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

Quick assessment

Affected
alexandregz twofactor_gauthenticator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Roundcube 的 插件存在二次验证码被暴力破解的漏洞。由于缺乏速率限制，攻击者在获取用户密码后，可以提交任意 6 位数字代码，从而绕过二次验证并未经授权地访问系统。 该问题已在提交 4640889 中修复。

CVSS 6.3 · Medium

Possible ATT&CK Techniques 1 AI

T1110.001 · Password Guessing
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107145

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator
Source: CVE Program / CVE List V5
Vulnerability Description
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who obtains user's password can submit arbitrary 6-digit codes, resulting in second-factor bypass and unauthorized access to the system. This issue was fixed in commit 4640889.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
alexandregz twofactor_gauthenticator 0 ~ 4640889 -

II. Public POCs for CVE-2026-107145

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107145

请登录查看更多情报信息。

Other References for CVE-2026-107145 (2)

Same Patch Batch · alexandregz · 2026-10-27 · 3 CVEs total

CVE-2026-107146 6.3 MEDIUM Insufficient session expiration in twofactor_gauthenticator
CVE-2026-107147 6.3 MEDIUM Authentication bypass by spoofing in twofactor_gauthenticator

IV. Related Vulnerabilities

Same product: twofactor_gauthenticator
Same vendor: alexandregz
Same weakness: CWE-307