---
id: "CVE-2026-63437"
page: "https://infrastack.ai/live/CVE-2026-63437"
kind: "vulnerability"
aliases: ["CVE-2026-63437"]
title: "2FAuth: authenticated users can list recipients of other users' accounts"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["2fauth", "laravel", "package", "self-hosted"]
not_affected_if: ["sharing-disabled", "version-8.0.0-or-later"]
published_at: "2026-11-06T21:17:09+00:00"
first_seen_at: "2026-11-06T21:45:07+00:00"
updated_at: "2026-11-06T21:46:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63437", "first_seen_at": "2026-11-06T21:45:07+00:00"}]
exploit_sources: []
---

# 2FAuth: authenticated users can list recipients of other users' accounts

Link for people: https://infrastack.ai/live/CVE-2026-63437 (this .md is for agents)

2FAuth, a self-hosted web app that stores two-factor authentication accounts, lets any logged-in user call an API endpoint that lists the recipients of accounts they do not own. An attacker can enumerate user IDs, display names and test exact email addresses, and see each account's sharing relationships.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed 2FAuth version; the fix is in `8.0.0` and earlier versions are affected.
- Check whether account sharing is enabled in the 2FAuth configuration.
- Review API access logs for `GET /api/v1/twofaccounts/{id}/recipients` requests from users who do not own that account.

## Fix

- 2FAuth: upgrade to `8.0.0`.

## Timeline

- 2026-11-06T21:45:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63437

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Bubka/2FAuth/security/advisories/GHSA-m52c-63g8-qg5c
- [fix] Patch: github.com https://github.com/Bubka/2FAuth/commit/08753afbd847da8fa285e2ad857693ff88e46b84
- [fix] Release notes: github.com https://github.com/Bubka/2FAuth/releases/tag/v8.0.0

## From the sources

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account's sharing relationships. This issue is fixed in version 8.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_