CVE-2026-63438: 2FAuth Reverse-Proxy Guard Creates Admin Accounts for Untrusted Clients (CVSS 9.8)

Overview

CVE-2026-63438 is a critical (CVSS 9.8) authentication flaw in 2FAuth, a self-hosted web app for managing two-factor authentication accounts and generating codes. It affects deployments using AUTHENTICATION_GUARD=reverse-proxy-guard and is fixed in 2FAuth 8.0.0. It was published November 6, 2026.

Vulnerability Details

When the reverse-proxy guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER value. The first account created is promoted to administrator, and the account email is synced from the configured mail header.

An unauthenticated remote client that can reach the application directly can therefore:

• Create an administrator account on a fresh instance
• Impersonate a known account and redirect that account's email address

Impact

2FAuth stores TOTP secrets, so an attacker with account access can read or generate second-factor codes for the victim's other services. Redirecting the account email also supports account recovery abuse.

Exploitation Status

No public exploit code is confirmed and the CVE is not in CISA's KEV catalog at the time of writing. OffSeq reports sensor observations for the companion issue CVE-2026-63439, though its wording does not make clear whether that was attack traffic or only exposed hosts.

Remediation

1. Upgrade to 2FAuth 8.0.0 or later.
2. Ensure the application is reachable only through your trusted reverse proxy, and that the proxy strips client-supplied REMOTE_USER and custom identity headers.
3. If you do not need proxy authentication, switch away from reverse-proxy-guard.
4. Audit the user table for unexpected accounts or changed email addresses, and rotate any TOTP secrets you suspect were exposed.

References

• NVD Entry: CVE-2026-63438
• VulDB: CVE-2026-63438
• The Hacker Wire analysis