CVE-2026-63441

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...

CVE-2026-63441 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...

CVE-2026-63441

The 2FAuth web application (versions 6.1.0 until 8.0.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) due to a flaw in the App\Services\Traits\ValidatesUrls::isPublicIp() method. This component fails to recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes. Consequently, an otpaut...

CVE-2026-63441 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...

EUVD-2026-118489

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...