{"id":"CVE-2026-63441","kind":"vulnerability","aliases":["CVE-2026-63441"],"related":[],"title":"2FAuth: NAT64 addresses bypass private-IP checks, enabling server-side request forgery","description":"2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\\Services\\Traits\\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0.","summary":"2FAuth, a self-hosted web app for managing two-factor codes, fails to block NAT64 IPv6 addresses when fetching account icons from otpauth URIs. An attacker can make the server fetch private, loopback or cloud metadata IPv4 targets and recover image-shaped responses or probe internal endpoints.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["2fauth","laravel","package","php","self-hosted"],"not_affected_if":["image-fetching-disabled","managed-hosting","no-nat64-path"],"how_to_check":"- Check the installed 2FAuth version; versions from 6.1.0 up to but not including 8.0.0 are affected.\n- Confirm whether remote image fetching for icons is enabled in the deployment.\n- Check whether the server has a NAT64 or DNS64 path to internal IPv4 addresses.","fix":"- Move to `8.0.0` or later.","status":"open","published_at":"2026-11-06T21:17:10+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","triaged_at":"2026-11-06T21:46:51+00:00","updated_at":"2026-11-06T21:46:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T21:46:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `8.0.0` or later.","reach":"network","title":"2FAuth: NAT64 addresses bypass private-IP checks, enabling server-side request forgery","impact":"medium","summary":"2FAuth, a self-hosted web app for managing two-factor codes, fails to block NAT64 IPv6 addresses when fetching account icons from otpauth URIs. An attacker can make the server fetch private, loopback or cloud metadata IPv4 targets and recover image-shaped responses or probe internal endpoints.","audience":"businesses","category":"package","nicknames":[],"who_cares":["2fauth","self-hosted","php","laravel"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"server fetches internal IPv4 targets and leaks image responses","analyst_note":"","how_to_check":"- Check the installed 2FAuth version; versions from 6.1.0 up to but not including 8.0.0 are affected.\n- Confirm whether remote image fetching for icons is enabled in the deployment.\n- Check whether the server has a NAT64 or DNS64 path to internal IPv4 addresses.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","image-fetching-disabled","no-nat64-path"],"who_is_affected":"Self-hosted 2FAuth deployments on versions from 6.1.0 up to 8.0.0 where remote icon fetching is enabled and the server can reach internal IPv4 targets through a NAT64 translation path. Instances without image fetching or without a NAT64 route to internal networks are much less exposed. Hosted or managed instances are the vendor's responsibility.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000762,"input_tokens":4505,"output_tokens":623,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-63441':17A,20A '/48':116C '/96':111C '1':115C '2fa':89C '2fauth':1A,21B,28B,78C '6.1.0':97C '64':109C,113C '8.0.0':99C,222C 'account':49B,90C,166C 'address':3A,46B,134C 'allow':201C 'app':34B,82C,100C 'attack':55B,177C 'authent':88C 'blind':215C 'block':43B 'buildfromremoteimag':191C 'bypass':4A 'check':8A 'cloud':64B,146C 'code':40B,95C 'craft':171C,185C 'cve':15A,18A 'deploy':150C 'direct':173C 'dns64':132C 'dns64-synthesized':131C 'embed':136C,199C 'enabl':9A,154C 'endpoint':77B,211C 'extern':176C 'factor':39B,87C 'fail':41B 'fetch':48B,60B,153C 'ff9b':110C,114C 'fix':219C 'forgeri':14A 'generat':92C 'get':196C 'holder':167C 'host':27B,32B 'http':195C 'icon':50B 'iconservic':190C 'imag':71B,123C,152C,203C 'image-shap':70B,202C 'import':183C 'induc':179C 'intern':76B,162C 'ip':7A 'ipv4':66B,137C,163C 'ipv6':45B,128C 'ispublicip':104C 'issu':193C,217C 'laravel':22B 'link':142C 'link-loc':141C 'liter':129C 'local':143C 'loopback':62B,144C 'make':57B 'manag':36B,84C 'metadata':65B,147C 'migrat':188C 'nat64':2A,44B,117C,157C 'otpauth':52B,121C 'packag':23B 'paramet':124C 'pass':126C 'path':159C 'payload':189C 'php':24B 'prefix':118C 'privat':6A,61B,140C 'private-ip':5A 'probe':75B,214C 'recogn':107C 'recov':69B,208C 'request':13A 'respons':73B,205C 'secur':94C 'self':26B,31B 'self-host':25B,30B 'server':11A,59B 'server-sid':10A 'servic':101C 'shape':72B,204C 'side':12A 'submit':169C 'synthes':133C 'target':67B,138C,164C,200C 'trait':102C 'translat':158C 'two':38B,86C 'two-factor':37B,85C 'uri':53B,122C,172C,186C 'validatesurl':103C 'version':221C 'victim':181C 'web':33B,81C 'whose':135C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted 2FAuth deployments on versions from 6.1.0 up to 8.0.0 where remote icon fetching is enabled and the server can reach internal IPv4 targets through a NAT64 translation path. Instances without image fetching or without a NAT64 route to internal networks are much less exposed. Hosted or managed instances are the vendor's responsibility.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["2fauth","laravel","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-2026':16A,19A '-63441':17A,20A '2fauth':1A 'address':3A 'bypass':4A 'check':8A 'cve':15A,18A 'enabl':9A 'forgeri':14A 'ip':7A 'nat64':2A 'privat':6A 'private-ip':5A 'request':13A 'server':11A 'server-sid':10A 'side':12A","search_b":"'2fauth':21B,28B 'account':49B 'address':46B 'app':34B 'attack':55B 'block':43B 'cloud':64B 'code':40B 'endpoint':77B 'factor':39B 'fail':41B 'fetch':48B,60B 'host':27B,32B 'icon':50B 'imag':71B 'image-shap':70B 'intern':76B 'ipv4':66B 'ipv6':45B 'laravel':22B 'loopback':62B 'make':57B 'manag':36B 'metadata':65B 'nat64':44B 'otpauth':52B 'packag':23B 'php':24B 'privat':61B 'probe':75B 'recov':69B 'respons':73B 'self':26B,31B 'self-host':25B,30B 'server':59B 'shape':72B 'target':67B 'two':38B 'two-factor':37B 'uri':53B 'web':33B","search_c":"'/48':116C '/96':111C '1':115C '2fa':89C '2fauth':78C '6.1.0':97C '64':109C,113C '8.0.0':99C,222C 'account':90C,166C 'address':134C 'allow':201C 'app':82C,100C 'attack':177C 'authent':88C 'blind':215C 'buildfromremoteimag':191C 'cloud':146C 'code':95C 'craft':171C,185C 'deploy':150C 'direct':173C 'dns64':132C 'dns64-synthesized':131C 'embed':136C,199C 'enabl':154C 'endpoint':211C 'extern':176C 'factor':87C 'fetch':153C 'ff9b':110C,114C 'fix':219C 'generat':92C 'get':196C 'holder':167C 'http':195C 'iconservic':190C 'imag':123C,152C,203C 'image-shap':202C 'import':183C 'induc':179C 'intern':162C 'ipv4':137C,163C 'ipv6':128C 'ispublicip':104C 'issu':193C,217C 'link':142C 'link-loc':141C 'liter':129C 'local':143C 'loopback':144C 'manag':84C 'metadata':147C 'migrat':188C 'nat64':117C,157C 'otpauth':121C 'paramet':124C 'pass':126C 'path':159C 'payload':189C 'prefix':118C 'privat':140C 'probe':214C 'recogn':107C 'recov':208C 'respons':205C 'secur':94C 'servic':101C 'shape':204C 'submit':169C 'synthes':133C 'target':138C,164C,200C 'trait':102C 'translat':158C 'two':86C 'two-factor':85C 'uri':122C,172C,186C 'validatesurl':103C 'version':221C 'victim':181C 'web':81C 'whose':135C","first_public_at":"2026-07-01T21:40:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63441","severity":null,"published_at":"2026-11-06T21:17:10+00:00","modified_at":"2026-11-06T21:17:10+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","fetched_at":"2026-11-06T21:45:08+00:00","note":null}],"documents":[{"id":90334,"url":"https://github.com/Bubka/2FAuth/commit/df19e7533082671ecc2e0c735adcd51e93b1cb4c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90321,"url":"https://github.com/Bubka/2FAuth/releases/tag/v8.0.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90336,"url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-wc8m-7c5g-xrrc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T21:40:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}