Description
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0.
Published: 2026-11-06
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: Server‑side request forgery that allows an authenticated user to reach internal network endpoints
Action: Patch
AI Analysis

Impact

Prior to version 8.0.0 2FAuth validated an otpauth image URL host but then performed a separate DNS look‑up for the same host when fetching the image. This check‑then‑use flaw creates a TOCTOU window that an attacker can exploit with DNS rebinding. By configuring a low‑TTL DNS record that resolves to a public address during validation and an internal address when the image is fetched, a logged‑in user can force the service to connect to loopback, private‑network, link‑local, or cloud metadata endpoints, potentially exposing sensitive internal resources. The weakness is a classic Server‑Side Request Forgery supported by CWE‑367 and CWE‑918.

Affected Systems

The vulnerability affects the Bubka 2FAuth web application. Users of 2FAuth prior to or equal to release version 8.0.0 are impacted. The vulnerability was fixed in release 8.0.0; earlier releases (e.g., 7.x series) contain the flaw.

Risk and Exploitability

The vulnerability has a CVSS score of 5.9, indicating moderate severity. No EPSS score is reported, and the issue is not listed in the CISA KEV catalog. The exploit requires an authenticated session and low‑TTL DNS control, so while the attack surface is limited to users who can log in and influence DNS, the impact on internal infrastructure can be significant if the attacker reaches corporate network services or cloud metadata endpoints.

Generated by OpenCVE AI on November 6, 2026 at 22:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update 2FAuth to version 8.0.0 or higher to apply the vendor fix
  • Disable external otpauth image fetching in the application settings if the feature is not needed
  • Restrict the application’s outbound network access to exclude private IP ranges, limiting potential SSRF targets

Generated by OpenCVE AI on November 6, 2026 at 22:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Bubka
Bubka 2fauth
Vendors & Products Bubka
Bubka 2fauth

Fri, 06 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Description 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0.
Title 2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)
Weaknesses CWE-367
CWE-918
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Bubka 2fauth
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-06T20:18:43.907Z

Reserved: 2026-07-16T19:35:57.767Z

Link: CVE-2026-63440

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T21:17:10.137

Modified: 2026-11-06T21:17:10.137

Link: CVE-2026-63440

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T22:45:12Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition

  • CWE-918

    Server-Side Request Forgery (SSRF)