Is CVE-2026-63437 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63437 being exploited in the wild.

How severe is CVE-2026-63437?

Medium severity, with a CVSS score of 6.5, published 6 November 2026.

Is there a fix for CVE-2026-63437?

Yes: fixed in 8.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63437 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-63437?

Check whether you run Bubka 2FAuth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63437: 2FAuth missing authorization on share recipients endpoint

CVE-2026-63437 · Severity: medium · CVSS 6.5 · Published 2026-11-06

2FAuth is a web application for managing Two-Factor Authentication accounts and generating security codes. Prior to version 8.0.0, an authenticated user could access another user's account sharing information without authorization, allowing them to enumerate registered user IDs, display names, and email addresses, and inspect other accounts' sharing relationships.

Technologies: Bubka 2FAuth. Vendors: Bubka.

Quick answers

Is CVE-2026-63437 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63437 being exploited in the wild.
How severe is CVE-2026-63437?: Medium severity, with a CVSS score of 6.5, published 6 November 2026.
Which products and versions are affected?: Bubka 2FAuth before 8.0.0.
Is there a fix for CVE-2026-63437?: Yes: fixed in 8.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63437 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-63437?: Check whether you run Bubka 2FAuth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.0.0

Technical details

The recipients() method in TwoFAccountShareController.php does not call the manageShares authorization policy before listing account recipients. An authenticated attacker can call GET /api/v1/twofaccounts/{victimId}/recipients to access other users' accounts via Laravel model binding, using filter[nameOrEmail] to enumerate and test exact email addresses and inspect sharing relationships.

Affected products

Bubka 2FAuth before 8.0.0

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.