CVE-2026-63441

Name of the Vulnerable Software and Affected Versions 2FAuth versions 6.1.0 through 7.9.9

Description An issue exists where the isPublicIp() function within AppServicesTraitsValidatesUrls fails to recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes. NAT64 is a mechanism that allows IPv6-only clients to communicate with IPv4-only servers. Consequently, an otpauth URI image parameter can include an IPv6 literal or DNS64-synthesized address that targets private, link-local, loopback, or cloud metadata IPv4 addresses. When image fetching is enabled and a NAT64 translation path exists, an account holder or an external attacker can use a crafted URI or migration payload to trigger the buildFromRemoteImage() function in IconService. This results in an HTTP GET request to the internal target, potentially allowing the recovery of image-shaped responses or blind probing of other endpoints.

Recommendations Update to version 8.0.0. As a temporary mitigation, disable image fetching to prevent the buildFromRemoteImage() function from issuing requests to remote targets.