{"id":"CVE-2026-63438","kind":"vulnerability","aliases":["CVE-2026-63438"],"related":[],"title":"2FAuth: forged proxy headers let unauthenticated clients become administrators","description":"2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0.","summary":"2FAuth, a web app that stores two-factor authentication accounts and generates their codes, trusts authentication headers from clients that did not come through the trusted reverse proxy when the reverse-proxy guard is enabled. An unauthenticated remote attacker can create an administrator account on a fresh instance, or take over and redirect the email of an existing account, which exposes 2FA secrets and admin functions.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["2fauth","package","php","reverse-proxy","self-hosted"],"not_affected_if":["default-config","managed-hosting","proxy-only-access"],"how_to_check":"- Check whether `AUTHENTICATION_GUARD` is set to `reverse-proxy-guard` in the 2FAuth environment configuration.\n- Check the installed 2FAuth version; versions below `8.0.0` are affected.\n- Check whether the instance accepts direct connections that bypass the trusted reverse proxy.","fix":"- 2FAuth: move to `8.0.0` or later.","status":"open","published_at":"2026-11-06T21:17:09+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","triaged_at":"2026-11-06T21:46:26+00:00","updated_at":"2026-11-06T21:46:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T21:46:26Z","model":"claude-haiku-5-5","output":{"fix":"- 2FAuth: move to `8.0.0` or later.","reach":"internet","title":"2FAuth: forged proxy headers let unauthenticated clients become administrators","impact":"high","summary":"2FAuth, a web app that stores two-factor authentication accounts and generates their codes, trusts authentication headers from clients that did not come through the trusted reverse proxy when the reverse-proxy guard is enabled. An unauthenticated remote attacker can create an administrator account on a fresh instance, or take over and redirect the email of an existing account, which exposes 2FA secrets and admin functions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["2fauth","self-hosted","reverse-proxy","php"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker becomes administrator and reads 2FA secrets","analyst_note":"Confirm the fixed version and patch links for 8.0.0 at the vendor advisory before relying on the fix status.","how_to_check":"- Check whether `AUTHENTICATION_GUARD` is set to `reverse-proxy-guard` in the 2FAuth environment configuration.\n- Check the installed 2FAuth version; versions below `8.0.0` are affected.\n- Check whether the instance accepts direct connections that bypass the trusted reverse proxy.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","proxy-only-access","managed-hosting"],"who_is_affected":"Only instances that set AUTHENTICATION_GUARD to reverse-proxy-guard are exposed. The flaw needs a client that can reach the application without passing through the trusted proxy, so an instance that only accepts traffic through the proxy is harder to reach. Self-hosted 2FAuth instances on a fresh install are the most at risk because the first account created becomes administrator.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000789,"input_tokens":4431,"output_tokens":691,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-63438':12A,15A '2fa':88B,104C,185C '2fauth':1A,16B,25B,93C '8.0.0':113C,196C 'accept':121C 'account':35B,70B,85B,105C,139C,149C,155C,183C 'admin':91B 'administr':9A,69B,151C,170C,188C 'app':28B,97C 'attack':65B 'authent':34B,41B,103C,115C,122C 'becom':8A 'client':7A,44B,126C,165C 'code':39B,110C 'come':48B 'configur':159C 'creat':67B,137C,148C,168C 'cve':10A,13A 'email':81B,156C,179C 'enabl':61B 'exist':84B 'expos':87B,184C 'factor':33B,102C 'first':147C 'fix':193C 'forg':2A 'fresh':73B,173C 'function':92B,189C 'generat':37B,107C 'guard':59B,116C,120C 'header':4A,42B,123C,161C 'host':24B 'imperson':176C 'instanc':74B,174C 'issu':191C 'known':182C 'let':5A 'mail':160C 'manag':99C 'packag':17B 'pass':130C 'php':18B 'prior':111C 'promot':145C 'proxi':3A,21B,53B,58B,119C,134C 'redirect':79B,178C 'remot':64B,143C,164C 'remoteuserprovid':135C 'retrievebyid':136C 'revers':20B,52B,57B,118C 'reverse-proxi':19B,56B 'reverse-proxy-guard':117C 'secret':89B,186C 'secur':109C 'self':23B 'self-host':22B 'store':30B 'synchron':153C 'take':76B 'therefor':167C 'trust':40B,51B,133C 'two':32B,101C 'two-factor':31B,100C 'unauthent':6A,63B,163C 'unknown':142C 'user':144C 'version':195C 'web':27B,96C","nicknames":[],"mitigations":[],"who_affected":"Only instances that set AUTHENTICATION_GUARD to reverse-proxy-guard are exposed. The flaw needs a client that can reach the application without passing through the trusted proxy, so an instance that only accepts traffic through the proxy is harder to reach. Self-hosted 2FAuth instances on a fresh install are the most at risk because the first account created becomes administrator.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["2fauth","critical","package","php","reverseproxy","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-63438':12A,15A '2fauth':1A 'administr':9A 'becom':8A 'client':7A 'cve':10A,13A 'forg':2A 'header':4A 'let':5A 'proxi':3A 'unauthent':6A","search_b":"'2fa':88B '2fauth':16B,25B 'account':35B,70B,85B 'admin':91B 'administr':69B 'app':28B 'attack':65B 'authent':34B,41B 'client':44B 'code':39B 'come':48B 'creat':67B 'email':81B 'enabl':61B 'exist':84B 'expos':87B 'factor':33B 'fresh':73B 'function':92B 'generat':37B 'guard':59B 'header':42B 'host':24B 'instanc':74B 'packag':17B 'php':18B 'proxi':21B,53B,58B 'redirect':79B 'remot':64B 'revers':20B,52B,57B 'reverse-proxi':19B,56B 'secret':89B 'self':23B 'self-host':22B 'store':30B 'take':76B 'trust':40B,51B 'two':32B 'two-factor':31B 'unauthent':63B 'web':27B","search_c":"'2fa':104C,185C '2fauth':93C '8.0.0':113C,196C 'accept':121C 'account':105C,139C,149C,155C,183C 'administr':151C,170C,188C 'app':97C 'authent':103C,115C,122C 'client':126C,165C 'code':110C 'configur':159C 'creat':137C,148C,168C 'email':156C,179C 'expos':184C 'factor':102C 'first':147C 'fix':193C 'fresh':173C 'function':189C 'generat':107C 'guard':116C,120C 'header':123C,161C 'imperson':176C 'instanc':174C 'issu':191C 'known':182C 'mail':160C 'manag':99C 'pass':130C 'prior':111C 'promot':145C 'proxi':119C,134C 'redirect':178C 'remot':143C,164C 'remoteuserprovid':135C 'retrievebyid':136C 'revers':118C 'reverse-proxy-guard':117C 'secret':186C 'secur':109C 'synchron':153C 'therefor':167C 'trust':133C 'two':101C 'two-factor':100C 'unauthent':163C 'unknown':142C 'user':144C 'version':195C 'web':96C","first_public_at":"2026-07-01T21:40:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63438","severity":null,"published_at":"2026-11-06T21:17:09+00:00","modified_at":"2026-11-06T21:17:09+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","fetched_at":"2026-11-06T21:45:07+00:00","note":null}],"documents":[{"id":90323,"url":"https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90324,"url":"https://github.com/Bubka/2FAuth/commit/8a4c395cac97f8b70b4a822639a6ad8a816f927c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90325,"url":"https://github.com/Bubka/2FAuth/commit/d9e58ac4a63fbd8a073e423567881c81a87915de","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90321,"url":"https://github.com/Bubka/2FAuth/releases/tag/v8.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90327,"url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-r9xx-45m8-mw24","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T21:40:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}