CVE-2026-63438criticalCWE-287

CVE-2026-63438: critical vulnerability in Bubka 2FAuth

2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value

Published

Follow this CVE+ Monitor 2FAuth

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Bubka · 2FAuth
Related CVEs — Bubka 2FAuth

In the same product, most dangerous first.

CVE-2024-52598HIGH2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/previewEPSS 0.6%CVE-2026-32133HIGH2FAuth has Blind SSRF in image parameter allows internal network access and moreEPSS 0.6%CVE-2023-36816MEDIUMCross-Site Scripting (XSS) at Account creation in 2FAuthEPSS 0.5%CVE-2024-52597MEDIUM2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access renderEPSS 0.4%CVE-2026-63439CRITICAL2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy VerificationEPSS —CVE-2026-63440MEDIUM2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)EPSS —