# CVE-2026-63439: 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification

Status: published. Published: 2026-11-06. Updated: 2026-11-06.

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the application directly can forge the selected identity header and authenticate as an existing user, including an administrator, gaining access to stored 2FA secrets and account or application management functions. This issue is fixed in version 8.0.0.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Bubka / 2FAuth: < 8.0.0 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 3.1: 9.8 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-287

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/Bubka/2FAuth/security/advisories/GHSA-mh8r-74x2-r457 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/Bubka/2FAuth/releases/tag/v8.0.0 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-63439; retrieved 2026-11-06; source updated 2026-11-06

Revision: 06ef54f01dcfa8a6293f62802253292a7face0490fd44ab333f350694e052f22

Canonical: https://y2.dev/cve/CVE-2026-63439

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.