Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-63441 (GCVE-0-2026-63441)

Vulnerability from nvd – Published: 2026-11-06 20:17 – Updated: 2026-11-06 20:17

Title

2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0.

Severity

4.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/df19e75330…	x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: >= 6.1.0, < 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.1.0, \u003c 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\\Services\\Traits\\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:17:58.819Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-wc8m-7c5g-xrrc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-wc8m-7c5g-xrrc"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/df19e7533082671ecc2e0c735adcd51e93b1cb4c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/df19e7533082671ecc2e0c735adcd51e93b1cb4c"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-wc8m-7c5g-xrrc",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63441",
    "datePublished": "2026-11-06T20:17:58.819Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-06T20:17:58.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63440 (GCVE-0-2026-63440)

Vulnerability from nvd – Published: 2026-11-06 20:18 – Updated: 2026-11-06 20:18

Title

2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/52e9db94f2…	x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:18:43.907Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-22mh-gmrh-gpwg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-22mh-gmrh-gpwg"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/52e9db94f2da2a6231d77c49537d6d88ce948ee1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/52e9db94f2da2a6231d77c49537d6d88ce948ee1"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-22mh-gmrh-gpwg",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63440",
    "datePublished": "2026-11-06T20:18:43.907Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-06T20:18:43.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63439 (GCVE-0-2026-63439)

Vulnerability from nvd – Published: 2026-11-06 20:22 – Updated: 2026-11-06 20:22

Title

2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application directly can forge the selected identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions. This issue is fixed in version 8.0.0.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/43873cbfba…	x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application directly can forge the selected identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions. This issue is fixed in version 8.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:22:31.651Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-mh8r-74x2-r457",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-mh8r-74x2-r457"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mh8r-74x2-r457",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63439",
    "datePublished": "2026-11-06T20:22:31.651Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-06T20:22:31.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63438 (GCVE-0-2026-63438)

Vulnerability from nvd – Published: 2026-11-06 20:20 – Updated: 2026-11-06 20:20

Title

2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/43873cbfba…	x_refsource_MISC
https://github.com/Bubka/2FAuth/commit/8a4c395cac…	x_refsource_MISC
https://github.com/Bubka/2FAuth/commit/d9e58ac4a6…	x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:20:27.407Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-r9xx-45m8-mw24",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-r9xx-45m8-mw24"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/8a4c395cac97f8b70b4a822639a6ad8a816f927c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/8a4c395cac97f8b70b4a822639a6ad8a816f927c"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/d9e58ac4a63fbd8a073e423567881c81a87915de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/d9e58ac4a63fbd8a073e423567881c81a87915de"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r9xx-45m8-mw24",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63438",
    "datePublished": "2026-11-06T20:20:27.407Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-06T20:20:27.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63437 (GCVE-0-2026-63437)

Vulnerability from nvd – Published: 2026-11-06 20:16 – Updated: 2026-11-06 20:16

Title

2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account's sharing relationships. This issue is fixed in version 8.0.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/08753afbd8…	x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account\u0027s sharing relationships. This issue is fixed in version 8.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:16:05.692Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-m52c-63g8-qg5c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-m52c-63g8-qg5c"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/08753afbd847da8fa285e2ad857693ff88e46b84",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/08753afbd847da8fa285e2ad857693ff88e46b84"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-m52c-63g8-qg5c",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63437",
    "datePublished": "2026-11-06T20:16:05.692Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-06T20:16:05.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32133 (GCVE-0-2026-32133)

Vulnerability from nvd – Published: 2026-03-11 21:45 – Updated: 2026-03-12 16:17

Title

2FAuth has Blind SSRF in image parameter allows internal network access and more

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0.

Severity

7.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-12 14:54 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32133",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-12T14:54:28.865284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-12T16:17:42.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T21:45:09.034Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8"
        }
      ],
      "source": {
        "advisory": "GHSA-8qp3-x2mp-j6f8",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth has Blind SSRF in image parameter allows internal network access and more"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32133",
    "datePublished": "2026-03-11T21:45:09.034Z",
    "dateReserved": "2026-03-10T22:19:36.546Z",
    "dateUpdated": "2026-03-12T16:17:42.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-52598 (GCVE-0-2024-52598)

Vulnerability from nvd – Published: 2024-11-20 14:09 – Updated: 2024-11-20 14:28

Title

2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-20 14:26 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
Bubka	2FAuth	Affected: < 5.4.1
bubka	2fauth	Affected: 0 , < 5.4.1 (custom) cpe:2.3:a:bubka:2fauth::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:bubka:2fauth:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "2fauth",
            "vendor": "bubka",
            "versions": [
              {
                "lessThan": "5.4.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-52598",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-20T14:26:59.708585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-20T14:28:57.571Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-20T14:09:45.400Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j"
        }
      ],
      "source": {
        "advisory": "GHSA-xwxc-w7v3-2p4j",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-52598",
    "datePublished": "2024-11-20T14:09:45.400Z",
    "dateReserved": "2024-11-14T15:05:46.770Z",
    "dateUpdated": "2024-11-20T14:28:57.571Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-52597 (GCVE-0-2024-52597)

Vulnerability from nvd – Published: 2024-11-20 14:01 – Updated: 2024-11-20 14:31

Title

2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim's session and access to their tokens. Version 5.4.1 contains a patch for the issue.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-20 14:29 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/93c508e118…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
Bubka	2FAuth	Affected: < 5.4.1
bubka	2fauth	Affected: 0 , < 5.4.1 (custom) cpe:2.3:a:bubka:2fauth::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:bubka:2fauth:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "2fauth",
            "vendor": "bubka",
            "versions": [
              {
                "lessThan": "5.4.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-52597",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-20T14:29:40.882595Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-20T14:31:57.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim\u0027s session and access to their tokens. Version 5.4.1 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-20T14:01:37.062Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d"
        }
      ],
      "source": {
        "advisory": "GHSA-q5p4-6q4v-gqg3",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-52597",
    "datePublished": "2024-11-20T14:01:37.062Z",
    "dateReserved": "2024-11-14T15:05:46.770Z",
    "dateUpdated": "2024-11-20T14:31:57.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-36816 (GCVE-0-2023-36816)

Vulnerability from nvd – Published: 2023-07-03 16:12 – Updated: 2024-11-22 16:44

Title

Cross-Site Scripting (XSS) at Account creation in 2FAuth

Summary

2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-22 16:44 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/releases/tag/v4.0.3	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 4.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.289Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q"
          },
          {
            "name": "https://github.com/Bubka/2FAuth/releases/tag/v4.0.3",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Bubka/2FAuth/releases/tag/v4.0.3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36816",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-22T16:44:18.408279Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-22T16:44:28.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-03T16:12:17.141Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v4.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v4.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-cwhq-2mcq-pp9q",
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Scripting (XSS) at Account creation in 2FAuth"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-36816",
    "datePublished": "2023-07-03T16:12:17.141Z",
    "dateReserved": "2023-06-27T15:43:18.384Z",
    "dateUpdated": "2024-11-22T16:44:28.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-63439 (GCVE-0-2026-63439)

Vulnerability from cvelistv5 – Published: 2026-11-06 20:22 – Updated: 2026-11-06 20:22

Title

2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application directly can forge the selected identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions. This issue is fixed in version 8.0.0.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/43873cbfba…	x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application directly can forge the selected identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions. This issue is fixed in version 8.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:22:31.651Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-mh8r-74x2-r457",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-mh8r-74x2-r457"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mh8r-74x2-r457",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63439",
    "datePublished": "2026-11-06T20:22:31.651Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-06T20:22:31.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63438 (GCVE-0-2026-63438)

Vulnerability from cvelistv5 – Published: 2026-11-06 20:20 – Updated: 2026-11-06 20:20

Title

2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/43873cbfba…	x_refsource_MISC
https://github.com/Bubka/2FAuth/commit/8a4c395cac…	x_refsource_MISC
https://github.com/Bubka/2FAuth/commit/d9e58ac4a6…	x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:20:27.407Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-r9xx-45m8-mw24",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-r9xx-45m8-mw24"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/8a4c395cac97f8b70b4a822639a6ad8a816f927c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/8a4c395cac97f8b70b4a822639a6ad8a816f927c"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/d9e58ac4a63fbd8a073e423567881c81a87915de",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/d9e58ac4a63fbd8a073e423567881c81a87915de"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-r9xx-45m8-mw24",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63438",
    "datePublished": "2026-11-06T20:20:27.407Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-06T20:20:27.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63440 (GCVE-0-2026-63440)

Vulnerability from cvelistv5 – Published: 2026-11-06 20:18 – Updated: 2026-11-06 20:18

Title

2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/52e9db94f2…	x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:18:43.907Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-22mh-gmrh-gpwg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-22mh-gmrh-gpwg"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/52e9db94f2da2a6231d77c49537d6d88ce948ee1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/52e9db94f2da2a6231d77c49537d6d88ce948ee1"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-22mh-gmrh-gpwg",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63440",
    "datePublished": "2026-11-06T20:18:43.907Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-06T20:18:43.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63441 (GCVE-0-2026-63441)

Vulnerability from cvelistv5 – Published: 2026-11-06 20:17 – Updated: 2026-11-06 20:17

Title

2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0.

Severity

4.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/df19e75330…	x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: >= 6.1.0, < 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.1.0, \u003c 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\\Services\\Traits\\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:17:58.819Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-wc8m-7c5g-xrrc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-wc8m-7c5g-xrrc"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/df19e7533082671ecc2e0c735adcd51e93b1cb4c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/df19e7533082671ecc2e0c735adcd51e93b1cb4c"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-wc8m-7c5g-xrrc",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63441",
    "datePublished": "2026-11-06T20:17:58.819Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-06T20:17:58.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63437 (GCVE-0-2026-63437)

Vulnerability from cvelistv5 – Published: 2026-11-06 20:16 – Updated: 2026-11-06 20:16

Title

2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account's sharing relationships. This issue is fixed in version 8.0.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/08753afbd8…	x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 8.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 8.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account\u0027s sharing relationships. This issue is fixed in version 8.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:16:05.692Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-m52c-63g8-qg5c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-m52c-63g8-qg5c"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/08753afbd847da8fa285e2ad857693ff88e46b84",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/08753afbd847da8fa285e2ad857693ff88e46b84"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v8.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-m52c-63g8-qg5c",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63437",
    "datePublished": "2026-11-06T20:16:05.692Z",
    "dateReserved": "2026-07-16T19:35:57.767Z",
    "dateUpdated": "2026-11-06T20:16:05.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-32133 (GCVE-0-2026-32133)

Vulnerability from cvelistv5 – Published: 2026-03-11 21:45 – Updated: 2026-03-12 16:17

Title

2FAuth has Blind SSRF in image parameter allows internal network access and more

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0.

Severity

7.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-12 14:54 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 6.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32133",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-12T14:54:28.865284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-12T16:17:42.667Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T21:45:09.034Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8"
        }
      ],
      "source": {
        "advisory": "GHSA-8qp3-x2mp-j6f8",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth has Blind SSRF in image parameter allows internal network access and more"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32133",
    "datePublished": "2026-03-11T21:45:09.034Z",
    "dateReserved": "2026-03-10T22:19:36.546Z",
    "dateUpdated": "2026-03-12T16:17:42.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-52598 (GCVE-0-2024-52598)

Vulnerability from cvelistv5 – Published: 2024-11-20 14:09 – Updated: 2024-11-20 14:28

Title

2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-20 14:26 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
Bubka	2FAuth	Affected: < 5.4.1
bubka	2fauth	Affected: 0 , < 5.4.1 (custom) cpe:2.3:a:bubka:2fauth::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:bubka:2fauth:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "2fauth",
            "vendor": "bubka",
            "versions": [
              {
                "lessThan": "5.4.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-52598",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-20T14:26:59.708585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-20T14:28:57.571Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-20T14:09:45.400Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j"
        }
      ],
      "source": {
        "advisory": "GHSA-xwxc-w7v3-2p4j",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-52598",
    "datePublished": "2024-11-20T14:09:45.400Z",
    "dateReserved": "2024-11-14T15:05:46.770Z",
    "dateUpdated": "2024-11-20T14:28:57.571Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-52597 (GCVE-0-2024-52597)

Vulnerability from cvelistv5 – Published: 2024-11-20 14:01 – Updated: 2024-11-20 14:31

Title

2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim's session and access to their tokens. Version 5.4.1 contains a patch for the issue.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-20 14:29 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/93c508e118…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
Bubka	2FAuth	Affected: < 5.4.1
bubka	2fauth	Affected: 0 , < 5.4.1 (custom) cpe:2.3:a:bubka:2fauth::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:bubka:2fauth:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "2fauth",
            "vendor": "bubka",
            "versions": [
              {
                "lessThan": "5.4.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-52597",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-20T14:29:40.882595Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-20T14:31:57.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim\u0027s session and access to their tokens. Version 5.4.1 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-20T14:01:37.062Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d"
        }
      ],
      "source": {
        "advisory": "GHSA-q5p4-6q4v-gqg3",
        "discovery": "UNKNOWN"
      },
      "title": "2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-52597",
    "datePublished": "2024-11-20T14:01:37.062Z",
    "dateReserved": "2024-11-14T15:05:46.770Z",
    "dateUpdated": "2024-11-20T14:31:57.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-36816 (GCVE-0-2023-36816)

Vulnerability from cvelistv5 – Published: 2023-07-03 16:12 – Updated: 2024-11-22 16:44

Title

Cross-Site Scripting (XSS) at Account creation in 2FAuth

Summary

2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-22 16:44 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7993 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/Bubka/2FAuth/security/advisori…	x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/releases/tag/v4.0.3	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Bubka	2FAuth	Affected: < 4.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.289Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q"
          },
          {
            "name": "https://github.com/Bubka/2FAuth/releases/tag/v4.0.3",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/Bubka/2FAuth/releases/tag/v4.0.3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36816",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-22T16:44:18.408279Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-22T16:44:28.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "2FAuth",
          "vendor": "Bubka",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-03T16:12:17.141Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-cwhq-2mcq-pp9q"
        },
        {
          "name": "https://github.com/Bubka/2FAuth/releases/tag/v4.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bubka/2FAuth/releases/tag/v4.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-cwhq-2mcq-pp9q",
        "discovery": "UNKNOWN"
      },
      "title": "Cross-Site Scripting (XSS) at Account creation in 2FAuth"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-36816",
    "datePublished": "2023-07-03T16:12:17.141Z",
    "dateReserved": "2023-06-27T15:43:18.384Z",
    "dateUpdated": "2024-11-22T16:44:28.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

18 vulnerabilities by bubka

CVE-2026-63441 (GCVE-0-2026-63441)

CVE-2026-63440 (GCVE-0-2026-63440)

CVE-2026-63439 (GCVE-0-2026-63439)

CVE-2026-63438 (GCVE-0-2026-63438)

CVE-2026-63437 (GCVE-0-2026-63437)

CVE-2026-32133 (GCVE-0-2026-32133)

CVE-2024-52598 (GCVE-0-2024-52598)

CVE-2024-52597 (GCVE-0-2024-52597)

CVE-2023-36816 (GCVE-0-2023-36816)

CVE-2026-63439 (GCVE-0-2026-63439)

CVE-2026-63438 (GCVE-0-2026-63438)

CVE-2026-63440 (GCVE-0-2026-63440)

CVE-2026-63441 (GCVE-0-2026-63441)

CVE-2026-63437 (GCVE-0-2026-63437)

CVE-2026-32133 (GCVE-0-2026-32133)

CVE-2024-52598 (GCVE-0-2024-52598)

CVE-2024-52597 (GCVE-0-2024-52597)

CVE-2023-36816 (GCVE-0-2023-36816)