CVE-2026-63438: 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value

Published Nov 6, 2026

Updated

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTEUSER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade 2FAuth to a version that resolves this vulnerability.
Fixed in 8.0.0

Event History

Nov 6, 2026

CVE Published

via MITRE·08:20 PM

Data Sourced

via MITRE·08:20 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

Deployments using AUTHENTICATION_GUARD=reverse-proxy-guard are exposed when authentication headers can be accepted from clients that have not passed through a trusted proxy. A fresh affected instance is especially at risk because the first attacker-created account is promoted to administrator.

What does an attacker need to exploit this issue?

The attacker needs network access to submit requests directly to an affected 2FAuth instance and control the authentication header used for REMOTE_USER. No prior account is required to create the first account on a fresh instance.

What can an attacker do against an existing account?

An attacker can impersonate a known account and redirect its email using the configured mail header. This can expose that account's 2FA secrets and administrative functions where applicable.

How can I determine whether my instance may be affected?

Check whether the instance is running a version earlier than 8.0.0 and whether AUTHENTICATION_GUARD is set to reverse-proxy-guard. Also determine whether the application can be reached directly by clients rather than only through a trusted proxy that controls authentication headers.

What should be done if an immediate upgrade is not possible?

Ensure clients cannot reach 2FAuth directly and that only a trusted reverse proxy can supply the authentication and configured mail headers. Review accounts for unexpected creations, administrator assignment, or changed email addresses.

CVE-2026-63438: 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What does an attacker need to exploit this issue?

What can an attacker do against an existing account?

How can I determine whether my instance may be affected?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What does an attacker need to exploit this issue?

What can an attacker do against an existing account?

How can I determine whether my instance may be affected?

What should be done if an immediate upgrade is not possible?