The twofactor_gauthenticator plugin for Roundcube has a vulnerability that allows bypassing two-factor authentication (2FA) by spoofing client address headers. An attacker who has obtained a user's password can spoof whitelisted IP addresses via the Client-IP and X-Forwarded-For headers, bypassing the second authentication factor. This issue has been fixed in commit 4640889.