Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-107146— Insufficient session expiration in twofactor_gauthenticator

Quick assessment

Affected
alexandregz twofactor_gauthenticator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Roundcube 的 插件存在双因素认证（2FA）验证失败后会话持续存在的漏洞。由于缺少服务器端的会话销毁机制，攻击者可以忽略登出重定向，使会话保持活跃状态。若攻击者已获取用户密码，则可能利用此漏洞对第二因素验证码进行暴力破解。 该问题已在提交 4640889 中修复。

CVSS 6.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-107146

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Insufficient session expiration in twofactor_gauthenticator
Source: CVE Program / CVE List V5
Vulnerability Description
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code. This issue was fixed in commit 4640889.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
alexandregz twofactor_gauthenticator 0 ~ 4640889 -

II. Public POCs for CVE-2026-107146

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-107146

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-107146 (1)

Other References for CVE-2026-107146 (1)

Same Patch Batch · alexandregz · 2026-10-27 · 3 CVEs total

CVE-2026-107147 6.3 MEDIUM Authentication bypass by spoofing in twofactor_gauthenticator
CVE-2026-107145 6.3 MEDIUM Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator

IV. Related Vulnerabilities

Same product: twofactor_gauthenticator
Same vendor: alexandregz
Same weakness: CWE-613