CVE-2026-63441

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0.

• CWE-918

• https://github.com/Bubka/2FAuth/commit/df19e7533082671ecc2e0c735adcd51e93b1cb4c
• https://github.com/Bubka/2FAuth/releases/tag/v8.0.0
• https://github.com/Bubka/2FAuth/security/advisories/GHSA-wc8m-7c5g-xrrc

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63436zt-zip is a Java library that provides convenience methods f…6.1
• CVE-2026-634372FAuth is a web app to manage Two-Factor Authentication (2FA…6.5
• CVE-2026-634382FAuth is a web app to manage Two-Factor Authentication (2FA…9.8
• CVE-2026-634392FAuth is a web app to manage Two-Factor Authentication (2FA…9.8
• CVE-2026-6344The Fluent Forms plugin for WordPress is vulnerable to Arbit…4.9
• CVE-2026-634402FAuth is a web app to manage Two-Factor Authentication (2FA…5.9
• CVE-2026-63442OPNsense is a FreeBSD based firewall and routing platform. P…8.1
• CVE-2026-63443Coder allows organizations to provision remote development e…8.3
• CVE-2026-63445Perses is an open-source dashboard and visualization project…7.1
• CVE-2026-63446Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63447Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63448Suricata is a network Intrusion Detection System, Intrusion …7.5