2Fauth

Vulnerabilities related to 2Fauth 5

• Critical 9.8 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUT... CVE-2026-63439 05:22
• Critical 9.8 2FAuthの脆弱性2件、認証なしで管理者に 8.0.0で修正 2FAuthのリバースプロキシ認証に、ヘッダーを偽装するだけで認証を回避できる脆弱性が2件あり、reverse-proxy-guardを使う環境が対象です。8.0.0へ更新し、アプリがプロキシ経由でしか届かない構成かも確認してください。 CVE-2026-63438 05:20
• Medium 5.9 2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU) 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HT... CVE-2026-63440 05:18
• Medium 4.9 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6... CVE-2026-63441 05:17
• Medium 6.5 2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manage... CVE-2026-63437 05:16