Advisories · Technology
Bubka 2FAuth.
Every CVE that names Bubka 2FAuth among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
2FAuth before 9.0.1 Password Reset Poisoning via Host Header
- Bubka 2FAuth
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification
- Bubka 2FAuth
- Authentication bypass
- CVSS 9.8 CriticalCritical · CVSS 9+
2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value
- Bubka 2FAuth
- Authentication bypass
- CVSS 5.9 Medium
2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)
- Bubka 2FAuth
- Race condition
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets
- Bubka 2FAuth
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration
- Bubka 2FAuth
- Broken access control
- CVSS 7.8 High
2FAuth has Blind SSRF in image parameter allows internal network access and more
- Bubka 2FAuth
- Server-side request forgery (SSRF)
- CVSS 7.5 High
2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview
- Bubka 2FAuth
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
- CVSS 6.1 Medium
2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render
- Bubka 2FAuth
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-Site Scripting (XSS) at Account creation in 2FAuth
- Bubka 2FAuth
- Cross-site scripting (XSS)