The vulnerability stems from a missing rate‑limiting mechanism in the twofactor_gauthenticator plugin for Roundcube, allowing an attacker who has acquired a user’s password to submit arbitrary 6‑digit authentication codes until a valid one is found. This bypasses the second‑factor protection and permits unauthorized access to the mailbox and underlying system. The weakness corresponds to CWE‑307: Authentication Bypass by Login Token Manipulation.

The affected product is the twofactor_gauthenticator plugin developed by alexandregz for the Roundcube webmail interface. No specific version information is provided, so all releases before the fix in commit 4640889 are considered vulnerable.

The CVSS score of 6.3 indicates a moderate level of severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited observable exploitation. However, an attacker who obtains valid credentials can repeatedly attempt the 6‑digit code without restriction, which could eventually succeed given the short code length. The likely attack vector is credential‑based remote access, originating from compromised user accounts or phishing campaigns.