Bubka 2Fauth vulnerabilities

CVE-2026-32133 [CRITICAL] CWE-918 CVE-2026-32133: 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security c 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly valid

CVE-2024-52598 [HIGH] CWE-79 CVE-2024-52598: 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security c 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it i

CVE-2024-52597 [MEDIUM] CWE-79 CVE-2024-52597: 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security c 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS

CVE-2023-36816 [MEDIUM] CWE-79 CVE-2023-36816: 2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security code 2FA is a Web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Cross site scripting (XSS) injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3.