{"id":"CVE-2026-63440","kind":"vulnerability","aliases":["CVE-2026-63440"],"related":[],"title":"2FAuth: DNS rebinding lets logged-in users reach internal network addresses","description":"2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0.","summary":"2FAuth, a self-hosted two-factor code manager, validates image URL hostnames and then resolves them again for the fetch, so a DNS record can switch to an internal address in between. An authenticated user can use this to make the server request loopback, private-network, link-local or cloud metadata endpoints.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["2fauth","laravel","package","php","self-hosted"],"not_affected_if":["auth-required","external-image-fetch-disabled"],"how_to_check":"- Check the installed 2FAuth version; affected releases are those before `8.0.0`.\n- Check whether external otpauth image fetching is enabled in the 2FAuth configuration (unknown setting name in the sources).","fix":"- Upgrade 2FAuth to `8.0.0`.","status":"open","published_at":"2026-11-06T21:17:10+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","triaged_at":"2026-11-06T21:46:47+00:00","updated_at":"2026-11-06T21:46:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T21:46:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade 2FAuth to `8.0.0`.","reach":"network","title":"2FAuth: DNS rebinding lets logged-in users reach internal network addresses","impact":"medium","summary":"2FAuth, a self-hosted two-factor code manager, validates image URL hostnames and then resolves them again for the fetch, so a DNS record can switch to an internal address in between. An authenticated user can use this to make the server request loopback, private-network, link-local or cloud metadata endpoints.","audience":"businesses","category":"package","nicknames":[],"who_cares":["2fauth","self-hosted","php","laravel"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"server requests reach internal services and cloud metadata endpoints","analyst_note":"","how_to_check":"- Check the installed 2FAuth version; affected releases are those before `8.0.0`.\n- Check whether external otpauth image fetching is enabled in the 2FAuth configuration (unknown setting name in the sources).","plain_action":"","needs_analyst":false,"not_affected_if":["external-image-fetch-disabled","auth-required"],"who_is_affected":"Self-hosted 2FAuth instances before 8.0.0 where external otpauth image fetching is enabled and users can add accounts with remote image URLs. The risk comes from the server making outbound requests on behalf of an authenticated user, so instances on private networks with cloud metadata endpoints are the most exposed. Instances with external image fetching disabled are not affected by this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000725,"input_tokens":4394,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-63440':15A,18A '2fa':93C '2fauth':1A,19B,26B,82C '8.0.0':102C,186C 'account':94C 'address':12A,57B,149C,155C,164C 'app':86C 'authent':61B,92C,137C 'authorit':143C 'bypass':160C 'cloud':79B,177C 'code':34B,99C 'connect':159C 'control':139C 'cve':13A,16A 'deni':165C 'dns':2A,50B,144C 'enabl':135C 'endpoint':81B,179C 'extern':130C 'factor':33B,91C 'fetch':47B,107C,133C 'fix':183C 'generat':96C 'host':25B,30B 'hostnam':39B,111C,123C 'http':127C 'iconservic':118C 'imag':37B,106C,132C 'image-fetch':105C 'intern':10A,56B,154C 'isexternalhost':114C 'issu':181C 'laravel':20B 'later':158C 'let':4A,117C 'link':76B,174C 'link-loc':75B,173C 'list':166C 'local':77B,175C 'log':6A 'logged-in':5A 'loopback':71B,169C 'low':141C 'low-ttl':140C 'make':67B 'manag':35B,88C 'metadata':80B,178C 'network':11A,74B,172C 'otpauth':104C,131C 'packag':21B 'path':108C 'php':22B 'prior':100C 'privat':73B,163C,171C 'private-address':162C 'private-network':72B,170C 'public':148C 'reach':9A,168C 'rebind':3A 'record':51B 'request':70B,128C 'resolv':42B,120C 'return':146C 'secur':98C 'self':24B,29B 'self-host':23B,28B 'server':69B 'storeremoteimag':119C 'switch':53B 'ttl':142C 'two':32B,90C 'two-factor':31B,89C 'url':38B 'use':64B 'user':8A,62B,138C 'valid':36B,109C,151C 'validatesurl':113C 'version':185C 'web':85C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted 2FAuth instances before 8.0.0 where external otpauth image fetching is enabled and users can add accounts with remote image URLs. The risk comes from the server making outbound requests on behalf of an authenticated user, so instances on private networks with cloud metadata endpoints are the most exposed. Instances with external image fetching disabled are not affected by this path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["2fauth","laravel","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-63440':15A,18A '2fauth':1A 'address':12A 'cve':13A,16A 'dns':2A 'intern':10A 'let':4A 'log':6A 'logged-in':5A 'network':11A 'reach':9A 'rebind':3A 'user':8A","search_b":"'2fauth':19B,26B 'address':57B 'authent':61B 'cloud':79B 'code':34B 'dns':50B 'endpoint':81B 'factor':33B 'fetch':47B 'host':25B,30B 'hostnam':39B 'imag':37B 'intern':56B 'laravel':20B 'link':76B 'link-loc':75B 'local':77B 'loopback':71B 'make':67B 'manag':35B 'metadata':80B 'network':74B 'packag':21B 'php':22B 'privat':73B 'private-network':72B 'record':51B 'request':70B 'resolv':42B 'self':24B,29B 'self-host':23B,28B 'server':69B 'switch':53B 'two':32B 'two-factor':31B 'url':38B 'use':64B 'user':62B 'valid':36B","search_c":"'2fa':93C '2fauth':82C '8.0.0':102C,186C 'account':94C 'address':149C,155C,164C 'app':86C 'authent':92C,137C 'authorit':143C 'bypass':160C 'cloud':177C 'code':99C 'connect':159C 'control':139C 'deni':165C 'dns':144C 'enabl':135C 'endpoint':179C 'extern':130C 'factor':91C 'fetch':107C,133C 'fix':183C 'generat':96C 'hostnam':111C,123C 'http':127C 'iconservic':118C 'imag':106C,132C 'image-fetch':105C 'intern':154C 'isexternalhost':114C 'issu':181C 'later':158C 'let':117C 'link':174C 'link-loc':173C 'list':166C 'local':175C 'loopback':169C 'low':141C 'low-ttl':140C 'manag':88C 'metadata':178C 'network':172C 'otpauth':104C,131C 'path':108C 'prior':100C 'privat':163C,171C 'private-address':162C 'private-network':170C 'public':148C 'reach':168C 'request':128C 'resolv':120C 'return':146C 'secur':98C 'storeremoteimag':119C 'ttl':142C 'two':90C 'two-factor':89C 'user':138C 'valid':109C,151C 'validatesurl':113C 'version':185C 'web':85C","first_public_at":"2026-07-01T21:40:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63440","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63440","severity":null,"published_at":"2026-11-06T21:17:10+00:00","modified_at":"2026-11-06T21:17:10+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","fetched_at":"2026-11-06T21:45:08+00:00","note":null}],"documents":[{"id":90331,"url":"https://github.com/Bubka/2FAuth/commit/52e9db94f2da2a6231d77c49537d6d88ce948ee1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90321,"url":"https://github.com/Bubka/2FAuth/releases/tag/v8.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90333,"url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-22mh-gmrh-gpwg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T21:40:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}