In 2FAuth versions prior to 8.0.0, the reverse‑proxy‑guard authentication mode accepts a REMOTE_USER header from an unauthenticated client that is not vetted against a trusted proxy. The application logic creates a new user account for the unknown REMOTE_USER value, automatically grants that first created account administrative privileges, and syncs the account email from a configured mail header. This allows an attacker to create an administrator on a fresh instance or hijack a known account and redirect its email, giving full access to all 2FA secrets and administrative functions.

The vulnerable product is Bubka's 2FAuth web application. All installations running any version earlier than 8.0.0—specifically the 7.x series—and any instance that configures AUTHENTICATION_GUARD=reverse‑proxy‑guard in an environment where the guard accepts headers from untrusted clients are affected. The fix was introduced in release 8.0.0, which removes automatic admin promotion and requires explicit provisioning.

The CVSS base score is 9.8, indicating a critical severity. The EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an attacker sending a crafted REMOTE_USER header directly to a publicly exposed 2FAuth instance that mistakenly enables reverse‑proxy‑guard against an untrusted client. Because this exploit only requires manual header manipulation and no authentication credentials, the condition for successful exploitation is relatively low; if such a misconfiguration exists, an attacker can trivially create an administrator and compromise the system.