Twofactor Gauthenticator
Monthly
Second-factor bypass in the Roundcube twofactor_gauthenticator plugin allows an attacker who already holds a victim's account password to skip the 2FA prompt by spoofing a whitelisted source address through attacker-controlled Client-IP or X-Forwarded-For headers. Exploitation is conditional: the plugin's IP-whitelist/trusted-address feature must be configured to skip 2FA for certain addresses, and the deployment must accept and trust client-supplied forwarding headers rather than having a reverse proxy strip or overwrite them. Severity is medium (CVSS 6.3, CWE-290), EPSS is low at 0.48% (41st percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and a fix is available in upstream commit 4640889.
Insufficient session termination in the Roundcube twofactor_gauthenticator plugin (all builds prior to commit 4640889) lets an attacker who already holds a victim's valid account password ignore the client-side logout redirect after a failed second-factor check and continue using the still-valid authenticated session to brute-force the TOTP code. The plugin fails to destroy the session server-side when verification fails, so the 2FA layer is weakened rather than bypassed outright - the stolen password remains a hard prerequisite, and success is bounded by TOTP entropy and any rate limiting, which is why the assessment rates attack complexity high with low confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis and EPSS is low (0.35%, 28th percentile); the vendor fix is commit 4640889 and the prioritisation label is this_month - a moderate, not emergency, priority.
Missing rate limiting on second-factor (TOTP) code verification in the Roundcube twofactor_gauthenticator plugin lets someone who already holds a user's valid Roundcube password submit unlimited 6-digit codes until one is accepted, defeating the second factor and granting unauthorized access to the account. All plugin versions below commit 4640889 are affected per EUVD (0 < 4640889). The flaw only bypasses the second factor, so prior full password compromise is mandatory; the vendor's CVSS:4.0 score of 6.3 reflects AC:H/AT:P, and both the CVSS 4.0 and the assessed CVSS:3.1 vectors carry PR:N while exploitation in practice requires the victim's first factor. EPSS is low (0.37%, 30th percentile), there is no CISA KEV entry, and no public exploit code was identified at time of analysis; a fix is published as commit 4640889.
Second-factor bypass in the Roundcube twofactor_gauthenticator plugin allows an attacker who already holds a victim's account password to skip the 2FA prompt by spoofing a whitelisted source address through attacker-controlled Client-IP or X-Forwarded-For headers. Exploitation is conditional: the plugin's IP-whitelist/trusted-address feature must be configured to skip 2FA for certain addresses, and the deployment must accept and trust client-supplied forwarding headers rather than having a reverse proxy strip or overwrite them. Severity is medium (CVSS 6.3, CWE-290), EPSS is low at 0.48% (41st percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, and a fix is available in upstream commit 4640889.
Insufficient session termination in the Roundcube twofactor_gauthenticator plugin (all builds prior to commit 4640889) lets an attacker who already holds a victim's valid account password ignore the client-side logout redirect after a failed second-factor check and continue using the still-valid authenticated session to brute-force the TOTP code. The plugin fails to destroy the session server-side when verification fails, so the 2FA layer is weakened rather than bypassed outright - the stolen password remains a hard prerequisite, and success is bounded by TOTP entropy and any rate limiting, which is why the assessment rates attack complexity high with low confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis and EPSS is low (0.35%, 28th percentile); the vendor fix is commit 4640889 and the prioritisation label is this_month - a moderate, not emergency, priority.
Missing rate limiting on second-factor (TOTP) code verification in the Roundcube twofactor_gauthenticator plugin lets someone who already holds a user's valid Roundcube password submit unlimited 6-digit codes until one is accepted, defeating the second factor and granting unauthorized access to the account. All plugin versions below commit 4640889 are affected per EUVD (0 < 4640889). The flaw only bypasses the second factor, so prior full password compromise is mandatory; the vendor's CVSS:4.0 score of 6.3 reflects AC:H/AT:P, and both the CVSS 4.0 and the assessed CVSS:3.1 vectors carry PR:N while exploitation in practice requires the victim's first factor. EPSS is low (0.37%, 30th percentile), there is no CISA KEV entry, and no public exploit code was identified at time of analysis; a fix is published as commit 4640889.