CVE-2026-63439

Name of the Vulnerable Software and Affected Versions 2FAuth versions prior to 8.0.0

Description When the AUTHENTICATION GUARD is set to reverse-proxy-guard, the ReverseProxyGuard::user() function reads the default REMOTE USER identity header or a custom header defined by the AUTH PROXY HEADER FOR USER configuration setting without verifying that the request originated from a trusted proxy. A remote client capable of reaching the application directly can forge these identity headers to authenticate as any existing user, including an administrator. This allows unauthorized access to stored 2FA secrets and account or application management functions.

Recommendations Update to version 8.0.0.