CVE-2026-63440 · Package
NO FIX YET · SEE WHAT TO DO
2FAuth, a self-hosted two-factor code manager, validates image URL hostnames and then resolves them again for the fetch, so a DNS record can switch to an internal address in between. An authenticated user can use this to make the server request loopback, private-network, link-local or cloud metadata endpoints.
first public Jul 1, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted 2FAuth instances before 8.0.0 where external otpauth image fetching is enabled and users can add accounts with remote image URLs. The risk comes from the server making outbound requests on behalf of an authenticated user, so instances on private networks with cloud metadata endpoints are the most exposed. Instances with external image fetching disabled are not affected by this path.
Not affected if auth-required, external-image-fetch-disabled
Who cares 2fauth, laravel, php, self-hosted
8.0.0.8.0.0.2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.