Read the docs
TI-2026-86110 Aliases CVE-2026-63437

Missing authorization exposes 2FAuth account recipients to other users

Priority LOW 29CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

2FAuth before 8.0.0 is a web app for managing two-factor authentication accounts. The recipients() method in the share controller loads a caller-selected account through model binding but does not run the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can list recipients of accounts owned by other users, which exposes registered user IDs and display names and lets them test exact email addresses. The flaw is a missing authorization check (CWE-862).

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account's sharing relationships. This issue is fixed in version 8.0.0.

Why it matters now

EPSS 0.00354 29th percentileScored 2026-11-07
Fix Fixed 2FAuth (Bubka): 8.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Bubka2FAuthbefore 8.0.08.0.0Patch availableCNA
  • 2FAuth VendorBubka Affected before 8.0.0 Fixed in 8.0.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:*——Bubka
  • cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:* Versions — — ·Bubka

Remediation

Update 2FAuth to version 8.0.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA 2FAuth (Bubka) Fixed in 8.0.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-63437
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-24670 2FAuth has Blind SSRF in image parameter allows internal network access and more CVSS 4.0HIGH 7.8
  • TI-2024-35258 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview CVSS 3.1HIGH 7.5
  • TI-2025-28827 A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned… CVSS 3.1MEDIUM 6.5
  • TI-2024-35257 2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render CVSS 3.1MEDIUM 6.1
  • TI-2023-18610 Cross-Site Scripting (XSS) at Account creation in 2FAuth CVSS 3.1MEDIUM 6.1
  • TI-2026-86111 Reverse proxy guard in 2FAuth accepts unauthenticated user headers CVSS 3.1CRITICAL 9.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences