CVE-2026-63440

Name of the Vulnerable Software and Affected Versions 2FAuth versions prior to 8.0.0

Description An issue exists in the otpauth image-fetch path where a hostname is validated using ValidatesUrls::isExternalHost() and subsequently resolved again by IconService::storeRemoteImage() for the HTTP request. If external otpauth image fetching is enabled, an authenticated user with control over low-TTL authoritative DNS can provide a public address during the validation phase and an internal address during the connection phase. This allows the user to bypass the private-address deny list and access loopback, private-network, link-local, or cloud metadata endpoints.

Recommendations Update to version 8.0.0.