Read the docs
TI-2026-24670 Aliases CVE-2026-32133

2FAuth has Blind SSRF in image parameter allows internal network access and more

Priority HIGH 73CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00587 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed 2FAuth (Bubka): 6.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Bubka2FAuthbefore 6.1.06.1.0Patch availableCNA
  • 2FAuth VendorBubka Affected before 6.1.0 Fixed in 6.1.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:*before 6.1.0VulnerableBubka
  • cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:* Versions before 6.1.0 Vulnerable ·Bubka

Remediation

  • Fix · CNA 2FAuth (Bubka) Fixed in 6.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-32133

References

Exploit 1

  • TI-2024-35258 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview CVSS 3.1HIGH 7.5
  • TI-2025-28827 A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned… CVSS 3.1MEDIUM 6.5
  • TI-2024-35257 2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render CVSS 3.1MEDIUM 6.1
  • TI-2023-18610 Cross-Site Scripting (XSS) at Account creation in 2FAuth CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences