---
id: "CVE-2026-63441"
page: "https://infrastack.ai/live/CVE-2026-63441"
kind: "vulnerability"
aliases: ["CVE-2026-63441"]
title: "2FAuth: NAT64 addresses bypass private-IP checks, enabling server-side request forgery"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["2fauth", "laravel", "package", "php", "self-hosted"]
not_affected_if: ["image-fetching-disabled", "managed-hosting", "no-nat64-path"]
published_at: "2026-11-06T21:17:10+00:00"
first_seen_at: "2026-11-06T21:45:08+00:00"
updated_at: "2026-11-06T21:46:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63441", "first_seen_at": "2026-11-06T21:45:08+00:00"}]
exploit_sources: []
---

# 2FAuth: NAT64 addresses bypass private-IP checks, enabling server-side request forgery

Link for people: https://infrastack.ai/live/CVE-2026-63441 (this .md is for agents)

2FAuth, a self-hosted web app for managing two-factor codes, fails to block NAT64 IPv6 addresses when fetching account icons from otpauth URIs. An attacker can make the server fetch private, loopback or cloud metadata IPv4 targets and recover image-shaped responses or probe internal endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed 2FAuth version; versions from 6.1.0 up to but not including 8.0.0 are affected.
- Confirm whether remote image fetching for icons is enabled in the deployment.
- Check whether the server has a NAT64 or DNS64 path to internal IPv4 addresses.

## Fix

- Move to `8.0.0` or later.

## Timeline

- 2026-11-06T21:45:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63441

## Documents

- [advisory] Vendor advisory: github.com https://github.com/Bubka/2FAuth/security/advisories/GHSA-wc8m-7c5g-xrrc
- [fix] Patch: github.com https://github.com/Bubka/2FAuth/commit/df19e7533082671ecc2e0c735adcd51e93b1cb4c
- [fix] Release notes: github.com https://github.com/Bubka/2FAuth/releases/tag/v8.0.0

## From the sources

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_