# CVE-2023-54391: Proxmox Virtual Environment authentication bypass in libpve-access-control

Source: https://junglewise.ai/threats/cve-2023-54391-proxmox-virtual-environment-authentication-bypass-in-libpve  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-54391 · Severity: critical · CVSS 9.8 · Published 2026-09-01

Proxmox Virtual Environment (VE) is a virtualization management platform used to control virtual machines and containers across datacenters. Versions 7.0 through early 8.0 contain an authentication bypass flaw that allows attackers without credentials to log in as any user—including root—by submitting a forged two-factor authentication parameter. This completely bypasses password verification and could give attackers full control of all virtual infrastructure managed by the platform.

Vendors: [Proxmox](https://junglewise.ai/threats/vendors/proxmox).

## Quick answers

**Is CVE-2023-54391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-54391 being exploited in the wild.

**How severe is CVE-2023-54391?** Critical severity, with a CVSS score of 9.8, published 1 September 2026.

**Which products and versions are affected?** Proxmox Libpve-Access-Control 7.0-7 through 8.0.3.

**Is there a fix for CVE-2023-54391?** A patch was published on 2023-07-20: libpve-access-control 8.0.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-54391 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-54391?** Check whether you run Proxmox Libpve-Access-Control at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in libpve-access-control affecting versions 7.0-7 through 8.0.3 (fixed in 8.0.4, released 2023-07-20). The API login endpoint (POST /api2/json/access/ticket) accepts a 'tfa-challenge' parameter intended to complete two-factor authentication; however, the parameter was not validated for users without configured second factors, and its mere presence caused password verification to be skipped entirely. An unauthenticated attacker can supply an arbitrary tfa-challenge value to authenticate as any enabled user without second factor configured, gaining full administrative access. The attack requires only network access to the API endpoint; no authentication or user interaction is required. All affected releases are end-of-life; no currently supported version is vulnerable.

## Affected products

- Proxmox libpve-access-control 7.0-7 through 8.0.3

## Timeline

- 2026-09-01: disclosed: Public security advisory PSA-2026-00043-1 published
- 2023-07-20: patched: libpve-access-control 8.0.4 released with fix

## References

- [https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4](https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4)
- [https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=032e7d6d441f89a48cadfd7f47e957c8a561c022](https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=032e7d6d441f89a48cadfd7f47e957c8a561c022)