# CVE-2026-63437: 2FAuth missing authorization on share recipients endpoint

Source: https://junglewise.ai/threats/cve-2026-63437-2fauth-is-a-web-app-to-manage-two-factor-authentication-2fa  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-63437 · Severity: medium · CVSS 6.5 · Published 2026-11-06

2FAuth is a web application for managing Two-Factor Authentication accounts and generating security codes. Prior to version 8.0.0, an authenticated user could access another user's account sharing information without authorization, allowing them to enumerate registered user IDs, display names, and email addresses, and inspect other accounts' sharing relationships.

Technologies: [Bubka 2FAuth](https://junglewise.ai/threats/technologies/2fauth). Vendors: [Bubka](https://junglewise.ai/threats/vendors/bubka).

## Quick answers

**Is CVE-2026-63437 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63437 being exploited in the wild.

**How severe is CVE-2026-63437?** Medium severity, with a CVSS score of 6.5, published 6 November 2026.

**Which products and versions are affected?** Bubka 2FAuth before 8.0.0.

**Is there a fix for CVE-2026-63437?** Yes: fixed in 8.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63437 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-63437?** Check whether you run Bubka 2FAuth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.0.0

## Technical details

The recipients() method in TwoFAccountShareController.php does not call the manageShares authorization policy before listing account recipients. An authenticated attacker can call GET /api/v1/twofaccounts/{victimId}/recipients to access other users' accounts via Laravel model binding, using filter[nameOrEmail] to enumerate and test exact email addresses and inspect sharing relationships.

## Affected products

- Bubka 2FAuth before 8.0.0

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/Bubka/2FAuth/commit/08753afbd847da8fa285e2ad857693ff88e46b84](https://github.com/Bubka/2FAuth/commit/08753afbd847da8fa285e2ad857693ff88e46b84)
- [https://github.com/Bubka/2FAuth/releases/tag/v8.0.0](https://github.com/Bubka/2FAuth/releases/tag/v8.0.0)

## Related threats

- [2FAuth SSRF via unrecognized IPv6 NAT64 prefixes](https://junglewise.ai/threats/cve-2026-63441-2fauth-is-a-web-app-to-manage-two-factor-authentication-2fa)
- [2FAuth SSRF via DNS rebinding in otpauth image fetch](https://junglewise.ai/threats/cve-2026-63440-2fauth-is-a-web-app-to-manage-two-factor-authentication-2fa)
- [2FAuth reverse proxy authentication bypass](https://junglewise.ai/threats/cve-2026-63439-2fauth-is-a-web-app-to-manage-two-factor-authentication-2fa)
- [2FAuth reverse-proxy authentication bypass leading to account creation](https://junglewise.ai/threats/cve-2026-63438-2fauth-is-a-web-app-to-manage-two-factor-authentication-2fa)