2FAuth allows a remote client to forge the identity header used by the reverse proxy guard, enabling an attacker to authenticate as any existing user, including administrators, without a valid credential. This flaw originates from the ReverseProxyGuard not verifying that the request originates from a trusted proxy before trusting the supplied header. The vulnerability is classified as an authentication bypass based on CWE-287.

All 2FAuth installations from the vendor Bubka that use versions earlier than 8.0.0 are affected. Version 8.0.0 introduces a fix that requires the request to originate from a configured trusted proxy before accepting the identity header.

The CVSS score of 9.8 indicates critical severity, and although EPSS data is unavailable, the issue is not listed in the CISA KEV catalog. A remote attacker who can reach the application directly can supply a forged identity header, making the exploit trivial to execute without additional conditions. Proper verification of the proxy or disabling the guard should mitigate the threat.