Roundcube 2FA plugin allows MFA bypass
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
Three flaws in Roundcube's twofactor_gauthenticator plugin let attackers with a stolen password brute-force or bypass two-factor authentication.
CERT Polska coordinated disclosure of three vulnerabilities in the twofactor_gauthenticator plugin for Roundcube webmail, reported by Marek Figielski (Vanilla.pl). All versions before commit 4640889 are affected. CVE-2026-107145 allows brute-forcing of the 6-digit TOTP code due to missing rate limiting, letting an attacker who already has a user's password submit unlimited guesses until the second factor is bypassed. CVE-2026-107146 involves insufficient server-side session destruction after a failed 2FA attempt, allowing an attacker to ignore the logout redirect and keep the session alive, facilitating prolonged brute-force attempts. CVE-2026-107147 allows authentication bypass via spoofed Client-IP and X-Forwarded-For headers, where an attacker can fake a whitelisted IP address to skip the second factor entirely.
In all three cases, exploitation requires the attacker to already possess the victim's password; the vulnerabilities then allow defeating the MFA protection layer. No evidence of in-the-wild exploitation is mentioned. Defenders running Roundcube with this plugin should upgrade to the fixed version (commit 4640889 or later) and review logs for repeated failed 2FA attempts, unusual session persistence, or anomalous Client-IP/X-Forwarded-For header values indicating spoofing attempts.
Mentioned in this report
Detection guidance
Roundcube Two-Factor Plugin Endpoint POST Requests (TOTP Brute-Force Candidate)
POST requests to the Roundcube twofactor_gauthenticator plugin action, which should be aggregated per source IP in the SIEM to find unthrottled TOTP guessing (CVE-2026-107145/107146). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Roundcube Two-Factor Plugin Endpoint POST Requests (TOTP Brute-Force Candidate)
description: Detects POST requests to the Roundcube twofactor_gauthenticator plugin
endpoint. Because the plugin lacked rate limiting and session destruction, brute-forcing
shows up as many such requests from one source in a short time. Alert on a threshold
per c-ip (for example 10 or more in 5 minutes) in the SIEM, since the threshold
cannot be expressed in the rule condition.
tags:
- attack.credential-access
- attack.t1110
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-query|contains: twofactor_gauthenticator
condition: selection
falsepositives:
- Legitimate users mistyping a TOTP code a few times or enrolling a new authenticator
level: low
id: f404775f-279e-5767-a383-dd28ec524806
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-107145
Scripted Client Hitting Roundcube Two-Factor Plugin Endpoint
Non-browser or scripting tool user agents submitting requests to the Roundcube 2FA plugin endpoint, indicating automated TOTP guessing or MFA bypass attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scripted Client Hitting Roundcube Two-Factor Plugin Endpoint
description: Detects automation tooling user agents sending requests to the Roundcube
twofactor_gauthenticator plugin endpoint, consistent with scripted TOTP brute-force
or 2FA bypass attempts by an attacker who already holds the password.
tags:
- attack.credential-access
- attack.t1110
logsource:
category: webserver
detection:
selection_uri:
cs-uri-query|contains: twofactor_gauthenticator
selection_ua:
cs-user-agent|contains:
- python-requests
- curl/
- Go-http-client
- libwww-perl
- Hydra
- sqlmap
- aiohttp
condition: selection_uri and selection_ua
falsepositives:
- Internal uptime or synthetic monitoring scripts that exercise the webmail login
flow
level: medium
id: 10ca7153-d104-5e7e-b69a-d47cfade9a9c
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/10/CVE-2026-107145
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-107145
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,312 reports from 144 sources, 603 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs