Read the docs
TI-2026-86112 Aliases CVE-2026-63439

2FAuth reverse proxy guard trusts client-supplied identity headers

Priority MEDIUM 42CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Bubka 2FAuth before 8.0.0 does not check that requests handled by its reverse proxy guard come from a configured trusted proxy (CWE-287). A remote client that can reach the application directly can forge the identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application directly can forge the selected identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions. This issue is fixed in version 8.0.0.

Why it matters now

EPSS 0.00406 35th percentileScored 2026-11-07
Fix Fixed 2FAuth (Bubka): 8.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Bubka2FAuthbefore 8.0.08.0.0Patch availableCNA
  • 2FAuth VendorBubka Affected before 8.0.0 Fixed in 8.0.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:*——Bubka
  • cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:* Versions — — ·Bubka

Remediation

Upgrade Bubka 2FAuth to version 8.0.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA 2FAuth (Bubka) Fixed in 8.0.0

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-63439

References

Other 3

  • TI-2026-24670 2FAuth has Blind SSRF in image parameter allows internal network access and more CVSS 4.0HIGH 7.8
  • TI-2024-35258 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview CVSS 3.1HIGH 7.5
  • TI-2025-28827 A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned… CVSS 3.1MEDIUM 6.5
  • TI-2024-35257 2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render CVSS 3.1MEDIUM 6.1
  • TI-2023-18610 Cross-Site Scripting (XSS) at Account creation in 2FAuth CVSS 3.1MEDIUM 6.1
  • TI-2026-86111 Reverse proxy guard in 2FAuth accepts unauthenticated user headers CVSS 3.1CRITICAL 9.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences