The twofactor_gauthenticator plugin for Roundcube allows attackers who have stolen a user’s password to bypass the second factor authentication by sending forged Client‑IP and X‑Forwarded‑For headers. This flaw enables the attacker to impersonate a whitelisted IP address, thereby gaining authorized access without the 2‑factor token. The vulnerability is an authentication bypass (CWE‑290) and can compromise user accounts and any data the attacker can access with those credentials.

The affected product is the twofactor_gauthenticator plugin by alexandregz for the Roundcube webmail application. No specific version range is provided, but the issue existed prior to the fix released in commit 4640889.

With a CVSS score of 6.3, the flaw is classified as medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires knowledge of the user’s password and the ability to craft HTTP headers, the likelihood of exploitation is moderate. The attack vector is inferred to be remote, originating from an external client that can reach the Roundcube instance.