CVE-2026-127088 · Other
NO FIX YET · SEE WHAT TO DO
2FAuth is a self-hosted two-factor authentication manager. Before version 9.0.1, a forged HTTP Host header in password recovery requests makes reset emails point at an attacker-controlled host, so the attacker captures the victim's token and gains access to stored TOTP/HOTP secrets.
first public Nov 2, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted 2FAuth instances running a version before 9.0.1 that accept password or WebAuthn recovery requests are exposed. The sources do not say whether managed or default configurations differ, so treat any running instance below 9.0.1 as affected.
Not affected if version-9.0.1-or-later
Who cares 2fauth, self-hosted, totp
9.0.1 or later.9.0.1 or later.2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.