CVE-2026-63438criticalCWE-287

CVE-2026-63438: fallo crítico en Bubka 2FAuth

2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value

Publicada el

Seguir esta CVE+ Monitorear 2FAuth

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

25Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Bubka · 2FAuth
CVEs relacionadas — Bubka 2FAuth

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-52598HIGH2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/previewEPSS 0.6%CVE-2026-32133HIGH2FAuth has Blind SSRF in image parameter allows internal network access and moreEPSS 0.6%CVE-2023-36816MEDIUMCross-Site Scripting (XSS) at Account creation in 2FAuthEPSS 0.5%CVE-2024-52597MEDIUM2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access renderEPSS 0.4%CVE-2026-63439CRITICAL2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy VerificationEPSS —CVE-2026-63440MEDIUM2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)EPSS —