CVE-2026-107146

The record

The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session destruction, an attacker can ignore the logout redirect and keep the session alive. This may allow an attacker who obtains user's password to e.g. brute force the second-factor code. This issue was fixed in commit 4640889.

Affected packages

Related vulnerabilities

• CVE-2026-63400 Coop is an open source review and moderation tool from ROOST. CWE-613
• CVE-2026-116251 pgAdmin 4 did not invalidate a user's existing sessions when their password changed… CWE-613
• CVE-2026-119577 ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows… CWE-613
• CVE-2026-118665 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. CWE-613
• CVE-2026-6647 In deployments of WSO2 Identity Server configured with a case-insensitive user store and… CWE-613
• CVE-2026-3583 When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection… CWE-613
• CVE-2026-117499 @fastify/session is a session plugin for Fastify. CWE-613
• CVE-2026-116894 REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that… CWE-613