EUVD-2023-60613

Proxmox Virtual Environment VE 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value ...

CVE-2023-54391

Proxmox Virtual Environment (VE) 7.0–8.0 contains an authentication bypass in libpve-access-control prior to version 8.0.4 . By supplying an arbitrary value in the tfa-challenge parameter of the API login endpoint, an unauthenticated attacker can skip password verification entirely and authentica...