CVE-2026-107146 in twofactor_gauthenticator
Summary
by MITRE • 10/27/2026
The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code.
This issue was fixed in commit 4640889.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The twofactor_gauthenticator plugin for Roundcube presents a critical authentication bypass vulnerability stemming from improper session management during two-factor authentication failures. This flaw allows an attacker to maintain access to a user's active session even after the second factor verification has failed, effectively negating the security controls intended by the multi-factor authentication implementation. The root cause lies in the application logic which fails to destroy or invalidate the server-side session upon encountering a verification error. In standard secure implementations, any failure during the authentication process should trigger an immediate termination of the current session state to prevent further exploitation attempts. However, due to this oversight, the session identifier remains valid and active on the server side despite the client-side redirect indicating a logout or failed login attempt.
This technical deficiency creates a significant operational impact by enabling brute-force attacks against the second factor code without triggering account lockouts or session invalidation mechanisms that are typically designed to mitigate such threats. An attacker who has already obtained the user's primary credentials, whether through phishing, credential stuffing, or other means of password compromise, can leverage this vulnerability to systematically guess the time-based one-time password generated by Google Authenticator. Since the session persists, the attacker retains access to the authentication interface and can submit multiple verification codes in rapid succession. This capability significantly reduces the entropy advantage provided by two-factor authentication, transforming a robust security control into a mere delay mechanism that is vulnerable to automated guessing attacks if the code space or lockout policies are not sufficiently restrictive.
From an industry standards perspective, this vulnerability aligns with CWE-613, which describes insufficient session expiration, and more specifically relates to CWE-287 regarding improper authentication where the system fails to properly enforce identity verification protocols. In terms of the MITRE ATT&CK framework, this flaw facilitates techniques associated with Credential Access and Defense Evasion, as it allows an adversary to bypass multi-factor authentication controls through persistence in a compromised session state rather than breaking into the account from scratch. The lack of server-side session destruction represents a fundamental deviation from secure coding practices outlined in guidelines such as OWASP Session Management Cheat Sheet, which mandates that sessions must be invalidated after any change in privilege level or upon failed login attempts to prevent session fixation and persistence attacks.
To mitigate this vulnerability, immediate patching is required by updating the twofactor_gauthenticator plugin to a version that includes commit 4640889, which addresses the session handling logic. Administrators should ensure that all instances of Roundcube running with this plugin are updated promptly. Additionally, organizations should review their authentication configurations to enforce strict lockout policies after a limited number of failed two-factor attempts, thereby adding an additional layer of defense against brute-force scenarios even if similar implementation flaws exist in other components. It is also advisable to implement server-side session validation checks that verify the integrity and state of sessions during each request related to sensitive operations, ensuring that any anomaly or failure in the authentication flow results in immediate session termination rather than persistence.