Bubka 2fauth vulnerabilities

• bubka 2fauth 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification CVE-2026-63439 9.8 CriticalNovember 6, 2026
• bubka 2fauth 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value CVE-2026-63438 9.8 CriticalNovember 6, 2026
• bubka 2fauth 2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU) CVE-2026-63440 5.9 MediumNovember 6, 2026
• bubka 2fauth 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets CVE-2026-63441 4.9 MediumNovember 6, 2026
• bubka 2fauth 2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration CVE-2026-63437 6.5 MediumNovember 6, 2026
• 2fauth 2FAuth has Blind SSRF in image parameter allows internal network access and more CVE-2026-32133 7.8 HighMarch 11, 2026
• 2fauth 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview CVE-2024-52598 7.5 HighNovember 20, 2024
• 2fauth 2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render CVE-2024-52597 6.1 MediumNovember 20, 2024
• 2fauth Cross-Site Scripting (XSS) at Account creation in 2FAuth CVE-2023-36816 6.1 MediumJuly 3, 2023