CVE-2026-63439

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes.

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application…

6. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-63439