Security Flaw in 2FAuth Web App for Two-Factor Authentication Management
CVE-2026-63441

4.9MEDIUM

Key Information:

Vendor

Bubka

Status
2fauth
Vendor
CVE Published:
6 November 2026

What is CVE-2026-63441?

The 2FAuth web application has a URL validation flaw that affects versions 6.1.0 to 8.0.0. The function isPublicIp() fails to recognize the NAT64 prefixes, allowing for crafted otpauth URI image parameters that may point to embedded IPv4 addresses, which can be private, link-local, or loopback. This vulnerability enables attackers to exploit image fetching capabilities and probe internal endpoints. Users should upgrade to version 8.0.0 or higher to mitigate this risk. Additional resources and fixes can be found in the official advisories and release notes.

Affected Version(s)

2FAuth >= 6.1.0, < 8.0.0

References

https://github.com/Bubka/2FAuth/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/Bubka/2FAuth/commit/df19e7533082671ecc...
x_refsource_MISC
https://github.com/Bubka/2FAuth/releases/tag/v8.0.0
x_refsource_MISC

CVSS V4

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.