CVE-2026-63439

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application directly can forge the selected identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions. This issue is fixed in version 8.0.0.

• CWE-287

• https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8
• https://github.com/Bubka/2FAuth/releases/tag/v8.0.0
• https://github.com/Bubka/2FAuth/security/advisories/GHSA-mh8r-74x2-r457

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63433MyTube is a self-hosted downloader and player for several vi…6.8
• CVE-2026-63434MyTube is a self-hosted downloader and player for several vi…4.3
• CVE-2026-63435Mail is an internet library for Ruby designed to handle emai…5.3
• CVE-2026-63436zt-zip is a Java library that provides convenience methods f…6.1
• CVE-2026-634372FAuth is a web app to manage Two-Factor Authentication (2FA…6.5
• CVE-2026-634382FAuth is a web app to manage Two-Factor Authentication (2FA…9.8
• CVE-2026-6344The Fluent Forms plugin for WordPress is vulnerable to Arbit…4.9
• CVE-2026-634402FAuth is a web app to manage Two-Factor Authentication (2FA…5.9
• CVE-2026-634412FAuth is a web app to manage Two-Factor Authentication (2FA…4.9
• CVE-2026-63442OPNsense is a FreeBSD based firewall and routing platform. P…8.1
• CVE-2026-63443Coder allows organizations to provision remote development e…8.3
• CVE-2026-63445Perses is an open-source dashboard and visualization project…7.1