Blind SSRF Vulnerability in 2FAuth Application by Bubka
CVE-2026-32133

7.8HIGH

Key Information:

Vendor

Bubka

Status
2fauth
Vendor
CVE Published:
11 March 2026

What is CVE-2026-32133?

A blind Server-Side Request Forgery (SSRF) vulnerability exists in the 2FAuth application, which is designed to manage Two-Factor Authentication (2FA) accounts. This flaw allows authenticated users to exploit the image parameter in OTP URLs, enabling them to send arbitrary HTTP requests to internal networks and cloud metadata endpoints without adequate validation. Prior attempts to safeguard the application only focused on response validation and did not address the underlying issue of unsanctioned requests, thereby exposing sensitive internal information. The vulnerability has been addressed in version 6.1.0.

Affected Version(s)

2FAuth < 6.1.0

References

https://github.com/Bubka/2FAuth/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V4

Score:
7.8
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.