Bubka 2FAuth vulnerabilities

Latest Bubka 2FAuth CVEs

Newest publication first

1. CVE-2026-63439 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification

   Published 2026-11-06

   Critical·CVSS 9.8 EPSS 0.41%

   2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header...

2. CVE-2026-63438 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value

   Published 2026-11-06

   Critical·CVSS 9.8 EPSS 0.51%

   2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retr...

3. CVE-2026-63440 2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)

   Published 2026-11-06

   Medium·CVSS 5.9 EPSS 0.20%

   2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostn...

4. CVE-2026-63441 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets

   Published 2026-11-06

   Medium·CVSS 4.9 EPSS 0.31%

   2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image paramet...

5. CVE-2026-63437 2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration

   Published 2026-11-06

   Medium·CVSS 6.5 EPSS 0.35%

   2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does...

6. CVE-2026-32133 2FAuth has Blind SSRF in image parameter allows internal network access and more

   Published 2026-03-11

   High·CVSS 7.8 EPSS 0.59%

   2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud met...

7. CVE-2024-52598 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview

   Published 2024-11-20

   High·CVSS 7.5 EPSS 0.59%

   2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote UR...

8. CVE-2024-52597 2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render

   Published 2024-11-20

   Medium·CVSS 6.1 EPSS 0.40%

   2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in se...

9. CVE-2023-36816 Cross-Site Scripting (XSS) at Account creation in 2FAuth

   Published 2023-07-03

   Medium·CVSS 6.1 EPSS 0.50%

   2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.