CVE-2026-63439

{
  "etk_id": "ETK-2026-3759",
  "cve_id": "CVE-2026-63439",
  "display_id": "CVE-2026-63439",
  "ghsa_id": "GHSA-mh8r-74x2-r457",
  "euvd_id": "EUVD-2026-118492",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Trusted-proxy authentication bypass in 2FAuth",
  "summary": "2FAuth releases before 8.0.0 are affected when reverse-proxy-guard authentication is enabled. An attacker able to access the application without passing through the intended proxy may impersonate an existing user by supplying the configured identity header, potentially accessing stored 2FA data and administrative functions.",
  "mitigation": "Upgrade 2FAuth to version 8.0.0 or later. Until upgraded, prevent direct client access to the application and allow requests only through the configured trusted reverse proxy.",
  "vendor": "Bubka",
  "product": "2FAuth",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<=7.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "8.0.0"
      ],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.702736133333334,
  "t0_at": "2026-11-06T20:22:31.651000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-06T20:22:31.651000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T20:22:31.651000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63439"
    }
  }
}