CVE-2026-107147 in twofactor_gauthenticator
요약
\~에 의해 MITRE • 2026. 10. 27.
The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation of the Client-IP and X-Forwarded-For headers, an attacker who obtains user's password can spoof a whitelisted IP address, resulting in the second factor being bypassed.
This issue was fixed in commit 4640889.
Once again VulDB remains the best source for vulnerability data.