Description
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0.
Published: 2026-11-06
Score: 4.9 Medium
EPSS: n/a
KEV: No
Impact: Server Side Request Forgery to Internal Resources
Action: Patch
AI Analysis

Impact

A server‑side request forgery flaw exists in 2FAuth versions 6.1.0 through 8.0.0. The URL validation routine fails to reject IPv6 NAT64 prefixes (64:ff9b::/96 and 64:ff9b:1::/48). When a crafted otpauth URI includes a DNS64‑generated IPv6 literal that resolves to a private, link‑local, loopback, or cloud‑metadata IPv4 address, the image service can fetch that internal target. The attacker can retrieve image‑like responses or probe other internal endpoints, resulting in unauthorized disclosure of internal data or sensitive metadata.

Affected Systems

The vulnerability appears in Bubka's 2FAuth web application, affecting all installations running versions 6.1.0 through 8.0.0. Vendors should verify their environment, as any system that enables remote image fetching is susceptible.

Risk and Exploitability

The CVSS score of 4.9 indicates a medium severity, and the EPSS score is not available, meaning the probability of exploitation is unknown but the lack of a KEV listing suggests no widespread public exploitation yet. However, the flaw allows an attacker to reach internal services via a publicly accessible web interface, making it a tangible risk for exposed deployments.

Generated by OpenCVE AI on November 6, 2026 at 21:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the fix shipped in version 8.0.0 of 2FAuth so that NAT64 prefixes are properly recognized and rejected.
  • If upgrading immediately is not possible, disable the remote image fetching feature or restrict it to trusted URLs only.
  • Implement network outbound filtering or firewall rules that block the NAT64 translation path to internal IP addresses, reducing the ability to reach internal resources from the web server.

Generated by OpenCVE AI on November 6, 2026 at 21:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Bubka
Bubka 2fauth
Vendors & Products Bubka
Bubka 2fauth

Fri, 06 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Description 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0.
Title 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets
Weaknesses CWE-918
References
Metrics cvssV4_0

{'score': 4.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Bubka 2fauth
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-06T20:17:58.819Z

Reserved: 2026-07-16T19:35:57.767Z

Link: CVE-2026-63441

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T21:17:10.307

Modified: 2026-11-06T21:17:10.307

Link: CVE-2026-63441

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T21:45:10Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)