Roundcube twofactor_gauthenticator EUVD-2026-110648

Two prerequisites gate this: (1) the attacker must already possess the victim's valid Roundcube password - the flaw only weakens the 2FA layer, it does not grant access on its own; and (2) the installed twofactor_gauthenticator version must predate commit 4640889, where the specific defect is that a failed second-factor verification does not trigger server-side session destruction, letting the attacker ignore the client-side logout redirect and continue using the authenticated session to brute-force the TOTP code. Limiting factors: no code execution or privilege escalation results; success is bounded by TOTP code entropy and any rate limiting, and the attack is pointless without the stolen password, which is why CVSS rates attack complexity high and all impacts low.

This is a moderate, not emergency, priority. CWE-613 (insufficient session expiration): the plugin never destroys the session server-side after a failed second-factor check, so an attacker can discard the logout redirect and keep an authenticated session alive. The supplied CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N, VC:L/VI:L/VA:L) is network-reachable but rates attack complexity high and all impacts low, consistent with a defense-in-depth bypass rather than direct compromise. Crucially, the description states exploitation presupposes an attacker who already obtained the user's password - the flaw only degrades the 2FA safety net by permitting offline-style brute forcing of the TOTP second factor, so PR:N reflects the CVSS scoring convention (a known credential is an attack prerequisite, not a plugin privilege) rather than a truly condition-free remote compromise. EPSS is low at 0.35% (28th percentile) and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the low-probability, defense-layer-degradation picture. Net: patch on a normal monthly cadence; this is a genuine but secondary-control weakness, not a high-CVSS-but-overrated critical.

An attacker who has already phished or otherwise stolen a Roundcube user's password logs in and reaches the 2FA prompt. Because a failed second-factor attempt does not destroy the session server-side, the attacker ignores the logout redirect and keeps the authenticated session alive, repeatedly submitting guesses to brute-force the victim's TOTP code and ultimately reach the mailbox. No public exploit has been identified at time of analysis; the attack requires prior possession of the valid password.