---
id: "CVE-2026-63439"
page: "https://infrastack.ai/live/CVE-2026-63439"
kind: "vulnerability"
aliases: ["CVE-2026-63439"]
title: "2FAuth: forged proxy identity header logs in as any user"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["2fauth", "package", "php", "reverse-proxy", "self-hosted"]
not_affected_if: ["behind-no-direct-access", "default-auth-guard", "version-8.0.0-or-later"]
published_at: "2026-11-06T21:17:09+00:00"
first_seen_at: "2026-11-06T21:45:07+00:00"
updated_at: "2026-11-06T21:46:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63439", "first_seen_at": "2026-11-06T21:45:07+00:00"}]
exploit_sources: []
---

# 2FAuth: forged proxy identity header logs in as any user

Link for people: https://infrastack.ai/live/CVE-2026-63439 (this .md is for agents)

2FAuth, a self-hosted two-factor code manager, trusts the REMOTE_USER identity header under its reverse-proxy authentication mode without checking the request came through a trusted proxy. A remote client that reaches the app directly can forge that header and log in as any user, including an administrator, gaining access to stored 2FA secrets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether `AUTHENTICATION_GUARD` is set to `reverse-proxy-guard` in the 2FAuth configuration.
- Check the installed 2FAuth version; versions before `8.0.0` are affected.
- Check whether the application port is reachable directly from outside the reverse proxy.

## Fix

- 2FAuth: upgrade to `8.0.0`.

## Timeline

- 2026-11-06T21:45:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63439

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Bubka/2FAuth/security/advisories/GHSA-mh8r-74x2-r457
- [fix] Patch: github.com https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8
- [fix] Release notes: github.com https://github.com/Bubka/2FAuth/releases/tag/v8.0.0

## From the sources

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application directly can forge the selected identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions. This issue is fixed in version 8.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_