CVE-2026-63441

The 2FAuth web application (versions 6.1.0 until 8.0.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) due to a flaw in the App\Services\Traits\ValidatesUrls::isPublicIp() method. This component fails to recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes. Consequently, an otpaut...