CVE-2026-63441 · Package
NO FIX YET · SEE WHAT TO DO
2FAuth, a self-hosted web app for managing two-factor codes, fails to block NAT64 IPv6 addresses when fetching account icons from otpauth URIs. An attacker can make the server fetch private, loopback or cloud metadata IPv4 targets and recover image-shaped responses or probe internal endpoints.
first public Jul 1, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted 2FAuth deployments on versions from 6.1.0 up to 8.0.0 where remote icon fetching is enabled and the server can reach internal IPv4 targets through a NAT64 translation path. Instances without image fetching or without a NAT64 route to internal networks are much less exposed. Hosted or managed instances are the vendor's responsibility.
Not affected if image-fetching-disabled, managed-hosting, no-nat64-path
Who cares 2fauth, laravel, php, self-hosted
8.0.0 or later.2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.