Read the docs
TI-2024-35257 Aliases CVE-2024-52597

2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim's session and access to their tokens. Version 5.4.1 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00395 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed 2FAuth (Bubka): 5.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Bubka2FAuthbefore 5.4.15.4.1Patch availableCNA
  • 2FAuth VendorBubka Affected before 5.4.1 Fixed in 5.4.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:*before 5.4.1VulnerableBubka
  • cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:* Versions before 5.4.1 Vulnerable ·Bubka

Remediation

  • Fix · CNA 2FAuth (Bubka) Fixed in 5.4.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52597

References

Exploit 1

Patch 1

  • TI-2026-24670 2FAuth has Blind SSRF in image parameter allows internal network access and more CVSS 4.0HIGH 7.8
  • TI-2024-35258 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview CVSS 3.1HIGH 7.5
  • TI-2025-28827 A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned… CVSS 3.1MEDIUM 6.5
  • TI-2023-18610 Cross-Site Scripting (XSS) at Account creation in 2FAuth CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences