CVE-2026-127088: 2FAuth before 9.0.1 Password Reset Poisoning via Host Header
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
2FAuth versions before 9.0.1 are affected. The issue applies to password and WebAuthn recovery flows that generate recovery emails using the supplied HTTP Host header.
What does an attacker need to exploit this?
An attacker does not need an account or prior privileges, but must be able to induce a victim to use a poisoned recovery link and capture the victim's recovery token. Exploitation requires user interaction.
What is the impact after a successful account takeover?
A successful takeover can expose TOTP/HOTP secrets stored in the victim's 2FAuth account. The vulnerability affects confidentiality and integrity, but no availability impact is specified.
How can this be remediated?
Upgrade 2FAuth to version 9.0.1 or later. The provided advisory and commit identify the fix for the Host header handling issue.