GHSA-8gqf-76mr-8wvcHighCVSS 8.1
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated...
🔗 CVE IDs covered (1)
📋 Description
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.
🔗 References (8)
- https://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv
- https://nvd.nist.gov/vuln/detail/CVE-2026-127088
- https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3
- https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47
- https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64
- https://github.com/Bubka/2FAuth/releases/tag/v9.0.1
- https://www.vulncheck.com/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header
- https://github.com/advisories/GHSA-8gqf-76mr-8wvc