CVE-2026-63437 · Package
NO FIX YET · SEE WHAT TO DO
2FAuth, a self-hosted web app that stores two-factor authentication accounts, lets any logged-in user call an API endpoint that lists the recipients of accounts they do not own. An attacker can enumerate user IDs, display names and test exact email addresses, and see each account's sharing relationships.
first public Jul 1, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a self-hosted 2FAuth instance on a version before 8.0.0 with account sharing enabled are exposed, since any authenticated user can query recipients of other users' accounts. Instances with sharing disabled, or that are only used by a single trusted user, carry much less risk.
Not affected if sharing-disabled, version-8.0.0-or-later
Who cares 2fauth, laravel, self-hosted
8.0.0 and earlier versions are affected.GET /api/v1/twofaccounts/{id}/recipients requests from users who do not own that account.8.0.0.2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account's sharing relationships. This issue is fixed in version 8.0.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.