{"id":"CVE-2026-63439","kind":"vulnerability","aliases":["CVE-2026-63439"],"related":[],"title":"2FAuth: forged proxy identity header logs in as any user","description":"2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application directly can forge the selected identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions. This issue is fixed in version 8.0.0.","summary":"2FAuth, a self-hosted two-factor code manager, trusts the REMOTE_USER identity header under its reverse-proxy authentication mode without checking the request came through a trusted proxy. A remote client that reaches the app directly can forge that header and log in as any user, including an administrator, gaining access to stored 2FA secrets.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["2fauth","package","php","reverse-proxy","self-hosted"],"not_affected_if":["behind-no-direct-access","default-auth-guard","version-8.0.0-or-later"],"how_to_check":"- Check whether `AUTHENTICATION_GUARD` is set to `reverse-proxy-guard` in the 2FAuth configuration.\n- Check the installed 2FAuth version; versions before `8.0.0` are affected.\n- Check whether the application port is reachable directly from outside the reverse proxy.","fix":"- 2FAuth: upgrade to `8.0.0`.","status":"open","published_at":"2026-11-06T21:17:09+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","triaged_at":"2026-11-06T21:46:26+00:00","updated_at":"2026-11-06T21:46:26+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-06T21:46:26Z","model":"claude-haiku-5-5","output":{"fix":"- 2FAuth: upgrade to `8.0.0`.","reach":"internet","title":"2FAuth: forged proxy identity header logs in as any user","impact":"high","summary":"2FAuth, a self-hosted two-factor code manager, trusts the REMOTE_USER identity header under its reverse-proxy authentication mode without checking the request came through a trusted proxy. A remote client that reaches the app directly can forge that header and log in as any user, including an administrator, gaining access to stored 2FA secrets.","audience":"businesses","category":"package","nicknames":[],"who_cares":["2fauth","self-hosted","reverse-proxy","php"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Attacker logs in as admin and reads stored 2FA secrets","analyst_note":"","how_to_check":"- Check whether `AUTHENTICATION_GUARD` is set to `reverse-proxy-guard` in the 2FAuth configuration.\n- Check the installed 2FAuth version; versions before `8.0.0` are affected.\n- Check whether the application port is reachable directly from outside the reverse proxy.","plain_action":"","needs_analyst":false,"not_affected_if":["default-auth-guard","behind-no-direct-access","version-8.0.0-or-later"],"who_is_affected":"Only installations that run 2FAuth before 8.0.0 with the reverse-proxy-guard authentication mode enabled are exposed. The risk is greatest when the application can be reached directly, bypassing the reverse proxy that is supposed to inject the identity header. Installations using other authentication guards are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000748,"input_tokens":4411,"output_tokens":613,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-63439':13A,16A '2fa':83B,96C,178C '2fauth':1A,17B,26B,85C '8.0.0':105C,192C 'access':80B,175C 'account':97C,181C 'administr':78B,173C 'app':64B,89C 'applic':157C,183C 'auth':132C 'authent':47B,95C,107C,166C 'came':53B 'check':50B 'client':60B,152C 'code':34B,102C 'configur':137C,147C 'confirm':140C 'custom':126C 'cve':11A,14A 'default':119C 'direct':65B,158C 'enabl':114C 'exist':169C 'factor':33B,94C 'fix':189C 'forg':2A,67B,160C 'function':185C 'gain':79B,174C 'generat':99C 'guard':108C,112C 'header':5A,41B,69B,123C,128C,134C,164C 'host':25B,30B 'ident':4A,40B,122C,127C,163C 'includ':76B,171C 'issu':187C 'log':6A,71B 'manag':35B,91C,184C 'mode':48B 'origin':144C 'packag':18B 'php':19B 'prior':103C 'proxi':3A,22B,46B,57B,111C,133C,149C 'reach':62B,155C 'read':117C 'remot':38B,59B,120C,151C 'request':52B,143C 'revers':21B,45B,110C 'reverse-proxi':20B,44B 'reverse-proxy-guard':109C 'reverseproxyguard':115C 'secret':84B,179C 'secur':101C 'select':129C,162C 'self':24B,29B 'self-host':23B,28B 'set':138C 'store':82B,177C 'trust':36B,56B,148C 'two':32B,93C 'two-factor':31B,92C 'user':10A,39B,75B,116C,121C,136C,170C 'version':191C 'web':88C 'without':49B,139C","nicknames":[],"mitigations":[],"who_affected":"Only installations that run 2FAuth before 8.0.0 with the reverse-proxy-guard authentication mode enabled are exposed. The risk is greatest when the application can be reached directly, bypassing the reverse proxy that is supposed to inject the identity header. Installations using other authentication guards are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["2fauth","critical","package","php","reverseproxy","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-63439':13A,16A '2fauth':1A 'cve':11A,14A 'forg':2A 'header':5A 'ident':4A 'log':6A 'proxi':3A 'user':10A","search_b":"'2fa':83B '2fauth':17B,26B 'access':80B 'administr':78B 'app':64B 'authent':47B 'came':53B 'check':50B 'client':60B 'code':34B 'direct':65B 'factor':33B 'forg':67B 'gain':79B 'header':41B,69B 'host':25B,30B 'ident':40B 'includ':76B 'log':71B 'manag':35B 'mode':48B 'packag':18B 'php':19B 'proxi':22B,46B,57B 'reach':62B 'remot':38B,59B 'request':52B 'revers':21B,45B 'reverse-proxi':20B,44B 'secret':84B 'self':24B,29B 'self-host':23B,28B 'store':82B 'trust':36B,56B 'two':32B 'two-factor':31B 'user':39B,75B 'without':49B","search_c":"'2fa':96C,178C '2fauth':85C '8.0.0':105C,192C 'access':175C 'account':97C,181C 'administr':173C 'app':89C 'applic':157C,183C 'auth':132C 'authent':95C,107C,166C 'client':152C 'code':102C 'configur':137C,147C 'confirm':140C 'custom':126C 'default':119C 'direct':158C 'enabl':114C 'exist':169C 'factor':94C 'fix':189C 'forg':160C 'function':185C 'gain':174C 'generat':99C 'guard':108C,112C 'header':123C,128C,134C,164C 'ident':122C,127C,163C 'includ':171C 'issu':187C 'manag':91C,184C 'origin':144C 'prior':103C 'proxi':111C,133C,149C 'reach':155C 'read':117C 'remot':120C,151C 'request':143C 'revers':110C 'reverse-proxy-guard':109C 'reverseproxyguard':115C 'secret':179C 'secur':101C 'select':129C,162C 'set':138C 'store':177C 'trust':148C 'two':93C 'two-factor':92C 'user':116C,121C,136C,170C 'version':191C 'web':88C 'without':139C","first_public_at":"2026-07-01T21:40:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63439","severity":null,"published_at":"2026-11-06T21:17:09+00:00","modified_at":"2026-11-06T21:17:09+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","fetched_at":"2026-11-06T21:45:07+00:00","note":null}],"documents":[{"id":90323,"url":"https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90321,"url":"https://github.com/Bubka/2FAuth/releases/tag/v8.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90330,"url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-mh8r-74x2-r457","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T21:40:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}