Authentication Bypass Vulnerability in Proxmox Virtual Environment
CVE-2023-54391

9.3CRITICAL

Key Information:

Vendor: Proxmox Server Solutions Gmbh
Status: Proxmox Virtual Environment (ve)
Vendor: CVE Published:; 1 September 2026

🔔 Create Proxmox Server Solutions Gmbh Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-54391?

Proxmox Virtual Environment versions from 7.0 to 8.0 are affected by an authentication bypass vulnerability in the libpve-access-control component. Attackers can exploit this vulnerability by sending an arbitrary tfa-challenge value to the API login endpoint, which allows them to bypass password verification and gain unauthorized access to user accounts, including the critical root@pam account. This vulnerability poses significant risks as all affected releases are no longer supported, leaving users exposed to potential attacks.

Affected Version(s)

Proxmox Virtual Environment (VE) 7.0 <= 7.4

Proxmox Virtual Environment (VE) 8.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

psa-2026-00043-recovery
Created by disqualifier