The twofactor_gauthenticator plugin for Roundcube has a vulnerability where sessions persist after failed two-factor authentication (2FA) attempts due to missing server-side session destruction. This flaw allows an attacker who has obtained a user's password to bypass the logout redirect and keep the session active, potentially enabling brute force attacks on the second-factor code. The issue has been fixed in a specific commit.