CVE-2026-107147 in twofactor_gauthenticator
Summary
by MITRE • 10/27/2026
The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed.
This issue was fixed in commit 4640889.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The twofactor_gauthenticator plugin for Roundcube presents a critical authentication weakness stemming from improper validation of client identity headers. This vulnerability allows an attacker to circumvent the second factor of two-factor authentication by manipulating HTTP request headers, specifically Client-IP and X-Forwarded-For. In many web application architectures, these headers are used to determine the originating IP address of a user when requests pass through reverse proxies or load balancers. The plugin relies on these values to enforce security policies such as trusted device lists or whitelisted IP ranges without verifying their authenticity against the actual network connection details provided by the underlying TCP/IP stack.
The technical flaw lies in the application's trust model regarding HTTP headers. An attacker who has already obtained a user's primary credentials, typically through phishing, credential stuffing, or other means of password compromise, can exploit this lack of validation to bypass the second factor entirely. By injecting spoofed values into the Client-IP and X-Forwarded-For headers that match an IP address previously whitelisted for the target account, the attacker tricks the authentication logic into believing the request originates from a trusted location. Consequently, the system skips the requirement for the Google Authenticator time-based one-time password, granting full access to the user's email account with only the first factor of authentication.
This vulnerability aligns with CWE-346, which describes an Origin Error where security decisions are based on untrusted data sources. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as it facilitates unauthorized access using legitimate credentials but bypasses additional security controls designed to protect those accounts. The operational impact is severe because two-factor authentication is intended to provide a robust defense-in-depth strategy against credential theft. By neutralizing the second factor through header manipulation, the attacker gains unrestricted access to sensitive communications and potentially further lateral movement within an organization if email credentials are used for single sign-on or password resets elsewhere.
Mitigation requires immediate implementation of fixes that validate client IP addresses at multiple layers rather than relying solely on HTTP headers. The application should prioritize the remote address provided by the web server's connection object, which is significantly harder to spoof from a remote attacker over standard TCP connections. If proxy headers must be used for legitimate load balancing scenarios, they should only be processed if the request originates from known and trusted internal proxy servers, thereby preventing external actors from injecting these values. The issue was addressed in commit 4640889, which likely introduces stricter validation logic to ensure that IP-based trust decisions are not influenced by unverified client-side input. Administrators should update to a patched version of the plugin immediately and review access logs for any signs of exploitation involving anomalous header values or successful logins from unexpected geographic locations following credential compromise events.