Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An unauthenticated remote client can therefore create an administrator on a fresh instance or impersonate and redirect email for a known account, exposing 2FA secrets and administrative functions. This issue is fixed in version 8.0.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🆕 New CVEs 2FAuth: 2 critical CVEs Worst: auth bypass in reverse proxy guard enables admin takeover (CVE-2026-63438) Patch → 8.0.0 https://cve.now/CVE-2026-63438?release=CVE-2026-63439&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup
🆕 New CVE: CVE-2026-63438 (CVSS 9.8, Enclave score 6/10) 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value Remote, no login needed. 2FAuth is a web app to manage Two-Factor Authentication (2FA)… https://app.enclave.ai/threat-feed/CVE-2026-63438
CVE-2026-63438 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guar… https://www.cve.org/CVERecord?id=CVE-2026-63438