CVE-2026-63437: medium-severity vulnerability in Bubka 2FAuth
2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account's sharing relationships. This issue is fixed in version 8.0.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Bubka · 2FAuthRelated CVEs — Bubka 2FAuth
In the same product, most dangerous first.
CVE-2024-52598HIGH2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/previewEPSS 0.6%CVE-2026-32133HIGH2FAuth has Blind SSRF in image parameter allows internal network access and moreEPSS 0.6%CVE-2023-36816MEDIUMCross-Site Scripting (XSS) at Account creation in 2FAuthEPSS 0.5%CVE-2024-52597MEDIUM2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access renderEPSS 0.4%CVE-2026-63439CRITICAL2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy VerificationEPSS —CVE-2026-63438CRITICAL2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header ValueEPSS —