CVE-2026-63438

The 2FAuth web application for managing Two-Factor Authentication (2FA) accounts is vulnerable to an Improper Authentication flaw (CWE-287) in versions prior to 8.0.0 . When the AUTHENTICATION_GUARD is set to reverse-proxy-guard, the RemoteUserProvider::retrieveById() function fails to properly v...

EUVD-2026-118491

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById creates an...