Threats affecting pkg:github/twofactor_gauthenticator

The twofactor_gauthenticator plugin for Roundcube has a vulnerability that allows bypassing two-factor authentication by spoofing client IP address headers. An attacker who has obtained a user's password can exploit the lack of validation of Client-IP and X-Forwarded-For headers to spoof a whitelisted IP address, thereby bypassing the second factor. This issue has been fixed in a specific commit.

The twofactor_gauthenticator plugin for Roundcube has a vulnerability where sessions persist after failed two-factor authentication (2FA) attempts due to insufficient session expiration. An attacker who obtains a user's password may exploit this to keep the session alive and attempt to brute force the second-factor code. This issue was fixed in a specific commit.

The twofactor_gauthenticator plugin for Roundcube suffers from a vulnerability that allows brute-forcing of the second-factor authentication code due to lack of rate limiting. An attacker who has obtained a user's password can repeatedly submit arbitrary 6-digit codes to bypass the second-factor authentication and gain unauthorized access. This issue has been fixed in a specific commit.