CVE-2026-63439 · Package
NO FIX YET · SEE WHAT TO DO
2FAuth, a self-hosted two-factor code manager, trusts the REMOTE_USER identity header under its reverse-proxy authentication mode without checking the request came through a trusted proxy. A remote client that reaches the app directly can forge that header and log in as any user, including an administrator, gaining access to stored 2FA secrets.
first public Jul 1, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only installations that run 2FAuth before 8.0.0 with the reverse-proxy-guard authentication mode enabled are exposed. The risk is greatest when the application can be reached directly, bypassing the reverse proxy that is supposed to inject the identity header. Installations using other authentication guards are not affected by this flaw.
Not affected if behind-no-direct-access, default-auth-guard, version-8.0.0-or-later
Who cares 2fauth, php, reverse-proxy, self-hosted
AUTHENTICATION_GUARD is set to reverse-proxy-guard in the 2FAuth configuration.8.0.0 are affected.8.0.0.2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application directly can forge the selected identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions. This issue is fixed in version 8.0.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.