CVE-2026-63438

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0.

• CWE-287

• https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8
• https://github.com/Bubka/2FAuth/commit/8a4c395cac97f8b70b4a822639a6ad8a816f927c
• https://github.com/Bubka/2FAuth/commit/d9e58ac4a63fbd8a073e423567881c81a87915de
• https://github.com/Bubka/2FAuth/releases/tag/v8.0.0
• https://github.com/Bubka/2FAuth/security/advisories/GHSA-r9xx-45m8-mw24

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63432Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 an…6.5
• CVE-2026-63433MyTube is a self-hosted downloader and player for several vi…6.8
• CVE-2026-63434MyTube is a self-hosted downloader and player for several vi…4.3
• CVE-2026-63435Mail is an internet library for Ruby designed to handle emai…5.3
• CVE-2026-63436zt-zip is a Java library that provides convenience methods f…6.1
• CVE-2026-634372FAuth is a web app to manage Two-Factor Authentication (2FA…6.5
• CVE-2026-634392FAuth is a web app to manage Two-Factor Authentication (2FA…9.8
• CVE-2026-6344The Fluent Forms plugin for WordPress is vulnerable to Arbit…4.9
• CVE-2026-634402FAuth is a web app to manage Two-Factor Authentication (2FA…5.9
• CVE-2026-634412FAuth is a web app to manage Two-Factor Authentication (2FA…4.9
• CVE-2026-63442OPNsense is a FreeBSD based firewall and routing platform. P…8.1
• CVE-2026-63443Coder allows organizations to provision remote development e…8.3