Authentication Bypass Vulnerability in Proxmox Virtual Environment
CVE-2023-54391

9.3CRITICAL

Key Information:

Vendor

Proxmox Server Solutions Gmbh

Status
Proxmox Virtual Environment (ve)
Vendor
CVE Published:
1 September 2026

What is CVE-2023-54391?

Proxmox Virtual Environment versions from 7.0 to 8.0 are affected by an authentication bypass vulnerability in the libpve-access-control component. Attackers can exploit this vulnerability by sending an arbitrary tfa-challenge value to the API login endpoint, which allows them to bypass password verification and gain unauthorized access to user accounts, including the critical root@pam account. This vulnerability poses significant risks as all affected releases are no longer supported, leaving users exposed to potential attacks.

Affected Version(s)

Proxmox Virtual Environment (VE) 7.0 <= 7.4

Proxmox Virtual Environment (VE) 8.0

References

https://forum.proxmox.com/threads/proxmox-virtual-environ...
vendor-advisory
https://git.proxmox.com/?p=pve-access-control.git;a=commi...
patch
https://git.proxmox.com/?p=pve-access-control.git;a=commi...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kamil Rakowski
Nathan Xavier Golez
Sagnik Sasmal
.