CVE-2023-54391 is an authentication bypass in Proxmox Virtual Environment (VE), the platform organisations use to host and manage virtual machines and containers. It matters most to the administrators running the Proxmox management plane: a remote, unauthenticated caller can turn a login request into a session for an existing enabled account, potentially including root@pam.
Proxmox VE is common wherever teams want to operate on-premises virtualisation without building around a large proprietary stack: internal IT departments, hosting providers, managed service providers, educational institutions, labs and smaller infrastructure teams. Its web and API management interfaces are powerful by design; control of one can mean control over the workloads, storage and networks attached to the cluster.
A second-factor field becomes the bypass
The flaw sits in libpve-access-control before version 8.0.4. Proxmox's login API supports a tfa-challenge parameter for the second step of multi-factor authentication (MFA), also called two-factor authentication. In the vulnerable code path, an attacker can POST to the access-ticket API endpoint and provide an arbitrary value for that parameter.
That supplied value causes password verification to be skipped for an existing enabled user that has no configured second factor. This is not an attacker guessing a weak password or defeating a configured MFA token. It is the login flow accepting a value intended for an MFA challenge in a way that bypasses the first credential check altogether.
The practical result is account impersonation. An attacker needs network reachability to the login API, but no valid Proxmox credentials and no prior foothold. If a target account meets the condition, the attacker can obtain authenticated access with that account's permissions. For root@pam, that would put the system's highest-privileged local management identity in reach.
Patch the management plane, then investigate it
The provided vulnerability data identifies Proxmox VE 7.0 through 8.0 as affected and says the issue is fixed in libpve-access-control 8.0.4 and later. It also says all affected releases are end of life. Teams should therefore not try to make an unsupported branch safe with compensating controls alone: upgrade to a supported Proxmox VE release that includes the corrected access-control library, following the vendor's normal upgrade guidance.
Until that is complete, reduce exposure immediately. Keep the management UI and API off the public internet; limit access to dedicated administrator networks, VPNs or tightly controlled jump hosts; and restrict firewall rules to the people and automation that genuinely need them. Inventory enabled accounts without a configured second factor, with particular attention to privileged identities. Adding MFA is useful defence in depth, but it should not be treated as the remediation for a bug specifically involving the MFA challenge flow.
The supplied material does not say that this issue is under active exploitation, is listed in CISA's Known Exploited Vulnerabilities catalog, or has a public proof of concept. It also does not specify whether any indicators or logging guidance were published. Given the ability to request a ticket as an account, review authentication and API logs around the upgrade window for unexpected successful sessions, especially for privileged users, and rotate relevant credentials if investigation raises doubt.
This is a reminder that virtualisation management endpoints deserve the same isolation and patch urgency as any other identity boundary. SecAlerts monitors an organisation's actual software stack and alerts on new vulnerabilities affecting the products it runs, helping teams spot when those boundaries need attention.
