The twofactor_gauthenticator plugin for Roundcube has a vulnerability that allows brute-forcing of the second-factor authentication code due to lack of rate limiting. An attacker who has obtained a user's password can repeatedly submit arbitrary 6-digit codes to bypass the second-factor authentication and gain unauthorized access. This issue has been fixed in a specific commit.