Overview
CVE-2026-63439 is a critical (CVSS 9.8) improper authentication vulnerability (CWE-287) in 2FAuth. When AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom header chosen through AUTH_PROXY_HEADER_FOR_USER, without confirming the request came from a configured trusted proxy. Fixed in 2FAuth 8.0.0; published November 6, 2026.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-63439 |
| CVSS Score | 9.8 (Critical) |
| CWE | CWE-287 (Improper Authentication) |
| Affected Software | 2FAuth before 8.0.0 (reverse-proxy-guard mode only) |
| Fixed Version | 8.0.0 |
| Advisory | GHSA-mh8r-74x2-r457 |
Vulnerability Details
Reverse-proxy authentication delegates login to a front-end such as Authelia, Authentik or an SSO proxy, which sets a header naming the authenticated user. That model is only safe if the application ignores the header unless the request truly arrived via that proxy. In affected versions, the guard trusted the header from any client. Anyone able to reach 2FAuth directly can send a header naming a victim and be treated as that user.
This is the authentication half of the problem. The account auto-creation and admin promotion behavior is covered in CVE-2026-63438.
Impact
- Full login as any user whose name the attacker can supply
- Access to stored TOTP secrets and generated codes
- Likely compromise of other accounts protected by those codes
Exploitation Status
No public exploit code is confirmed and the CVE is not in CISA's KEV catalog. OffSeq states its sensors saw either attack traffic or exposed hosts for this CVE, without making clear which.
Remediation
- Upgrade to 2FAuth 8.0.0 or later.
- Restrict network access so only the trusted reverse proxy can reach the application.
- Configure the proxy to strip any client-supplied
REMOTE_USERor custom identity header before setting its own. - Review authentication logs for logins that did not pass through your SSO provider.