CVE-2026-63437

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account's sharing relationships. This issue is fixed in version 8.0.0.

• CWE-639
• CWE-862

• https://github.com/Bubka/2FAuth/commit/08753afbd847da8fa285e2ad857693ff88e46b84
• https://github.com/Bubka/2FAuth/releases/tag/v8.0.0
• https://github.com/Bubka/2FAuth/security/advisories/GHSA-m52c-63g8-qg5c

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63431Horilla is an HR and CRM software. In 1.5.0-85 and earlier, …6.5
• CVE-2026-63432Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 an…6.5
• CVE-2026-63433MyTube is a self-hosted downloader and player for several vi…6.8
• CVE-2026-63434MyTube is a self-hosted downloader and player for several vi…4.3
• CVE-2026-63435Mail is an internet library for Ruby designed to handle emai…5.3
• CVE-2026-63436zt-zip is a Java library that provides convenience methods f…6.1
• CVE-2026-634382FAuth is a web app to manage Two-Factor Authentication (2FA…9.8
• CVE-2026-634392FAuth is a web app to manage Two-Factor Authentication (2FA…9.8
• CVE-2026-6344The Fluent Forms plugin for WordPress is vulnerable to Arbit…4.9
• CVE-2026-634402FAuth is a web app to manage Two-Factor Authentication (2FA…5.9
• CVE-2026-634412FAuth is a web app to manage Two-Factor Authentication (2FA…4.9
• CVE-2026-63442OPNsense is a FreeBSD based firewall and routing platform. P…8.1