CVE-2026-63438

Name of the Vulnerable Software and Affected Versions 2FAuth versions prior to 8.0.0

Description When the AUTHENTICATION GUARD is set to reverse-proxy-guard, the application may accept authentication headers from clients that have not passed through a trusted proxy. In this scenario, the RemoteUserProvider::retrieveById() function creates an account for an unknown REMOTE USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. This allows an unauthenticated remote client to create an administrator account on a new instance or impersonate an existing account and redirect its email, leading to the exposure of 2FA secrets and administrative functions.

Recommendations Update to version 8.0.0.