---
id: "CVE-2026-63438"
page: "https://infrastack.ai/live/CVE-2026-63438"
kind: "vulnerability"
aliases: ["CVE-2026-63438"]
title: "2FAuth: forged proxy headers let unauthenticated clients become administrators"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["2fauth", "package", "php", "reverse-proxy", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting", "proxy-only-access"]
published_at: "2026-11-06T21:17:09+00:00"
first_seen_at: "2026-11-06T21:45:07+00:00"
updated_at: "2026-11-06T21:46:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63438", "first_seen_at": "2026-11-06T21:45:07+00:00"}]
exploit_sources: []
---

# 2FAuth: forged proxy headers let unauthenticated clients become administrators

Link for people: https://infrastack.ai/live/CVE-2026-63438 (this .md is for agents)

2FAuth, a web app that stores two-factor authentication accounts and generates their codes, trusts authentication headers from clients that did not come through the trusted reverse proxy when the reverse-proxy guard is enabled. An unauthenticated remote attacker can create an administrator account on a fresh instance, or take over and redirect the email of an existing account, which exposes 2FA secrets and admin functions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether `AUTHENTICATION_GUARD` is set to `reverse-proxy-guard` in the 2FAuth environment configuration.
- Check the installed 2FAuth version; versions below `8.0.0` are affected.
- Check whether the instance accepts direct connections that bypass the trusted reverse proxy.

## Fix

- 2FAuth: move to `8.0.0` or later.

## Timeline

- 2026-11-06T21:45:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63438

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Bubka/2FAuth/security/advisories/GHSA-r9xx-45m8-mw24
- [fix] Patch: github.com https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8
- [fix] Patch: github.com https://github.com/Bubka/2FAuth/commit/8a4c395cac97f8b70b4a822639a6ad8a816f927c
- [fix] Patch: github.com https://github.com/Bubka/2FAuth/commit/d9e58ac4a63fbd8a073e423567881c81a87915de
- [fix] Release notes: github.com https://github.com/Bubka/2FAuth/releases/tag/v8.0.0

## From the sources

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_