CVE-2026-63439

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user reads the default REMOTEUSER identity header, or a custom identity header selected by the...

EUVD-2026-118492

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user reads the default REMOTEUSER identity header, or a custom identity header selected by the...

CVE-2026-63438

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById creates an...

EUVD-2026-118491

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById creates an...

CVE-2026-63440

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost and then lets IconService::storeRemoteImage resolve the same hostname again for the HTTP...

EUVD-2026-118490

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost and then lets IconService::storeRemoteImage resolve the same hostname again for the HTTP...

CVE-2026-63441

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...

EUVD-2026-118489

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...

EUVD-2026-118488

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, the recipients method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the...

CVE-2026-63437

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, the recipients method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the...

CVE-2026-32133

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. Th...

CVE-2026-32133: Server-Side Request Forgery (SSRF)

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. Th...

EUVD-2025-22514

Malicious code in bioql PyPI...

CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...

CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...

CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...

CVE-2025-45731

CVE-2025-45731 relates to a group deletion race condition in the 2FAuth v5.5.0 application. The issue arises when a group is deleted while other operations are pending, leading to data inconsistencies and orphaned accounts. The connected documents confirm the affected product and the underlying c...

CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...

PT-2025-30666 · 2Fauth · 2Fauth

Name of the Vulnerable Software and Affected Versions: 2FAuth version 5.5.0 Description: A group deletion race condition can lead to data inconsistencies and orphaned accounts when a group is deleted while other operations are in progress. Recommendations: At the moment, there is no information...

CVE-2025-45731

A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending...