twofactor_gauthenticator CVE-2026-107145

Requires: (1) the attacker already knows the victim's valid Roundcube password (first factor), since the flaw only defeats the second factor; (2) the account has TOTP second-factor enabled via the twofactor_gauthenticator plugin; and (3) an unpatched plugin version (before commit 4640889) where code submission is not rate-limited. Limiting factors that reduce realistic risk: prior full password compromise is mandatory, successful guessing must land a valid 6-digit TOTP within its validity window (reflected in the vendor's AC:H/AT:P scoring), and the issue is specific to this plugin rather than Roundcube core. The precise trigger mechanism beyond the absence of rate limiting is not described in the available sources.

This is a medium-severity authentication-weakness (CWE-307, missing rate limiting on TOTP verification), and the combined signals point to a real-but-non-urgent issue rather than a top-priority emergency. The CVSS 4.0 base score is 6.3 with AC:H and AT:P, indicating the attack is not trivially repeatable and carries an attack requirement (consistent with brute-forcing a 6-digit code against a time-bounded TOTP window); impact is rated Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L). EPSS is low at 0.37% (30th percentile) and there is no CISA KEV listing, so this reads as 'no public exploit identified at time of analysis' and not active mass exploitation. A key conflict to verify: the CVSS vector sets PR:N (which by the precision rules means unauthenticated), yet the description explicitly requires that the attacker first obtain the victim's password - so exploitation is not truly 'no credentials needed' and the PR:N scoring understates a real prerequisite. The vuln.today decision label is 'this_month' (not act_now/emergency), and a vendor patch exists, so the appropriate posture is scheduled remediation this month rather than crisis response. Net: a legitimate 2FA-bypass defeating the second authentication factor, but gated by prior password compromise, low exploitation probability, and no confirmed in-the-wild use.

An attacker who has already obtained a user's Roundcube password (via phishing, credential stuffing, or reuse) reaches the second-factor prompt and, because the twofactor_gauthenticator plugin does not rate-limit code submissions, automates guessing of 6-digit TOTP values until one is accepted. Succeeding bypasses the second factor and grants full access to the victim's webmail account. No public exploit identified at time of analysis; the trigger beyond 'lack of rate limiting' is not detailed in the available sources.