# CVE-2026-63438: 2FAuth reverse-proxy authentication bypass leading to account creation

Source: https://junglewise.ai/threats/cve-2026-63438-2fauth-is-a-web-app-to-manage-two-factor-authentication-2fa  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-63438 · Severity: critical · CVSS 9.8 · Published 2026-11-06

2FAuth is a web application that stores and manages two-factor authentication codes for user accounts. When configured to trust authentication headers from a reverse proxy, versions before 8.0.0 accept those headers from any client without verifying the request came through a legitimate proxy, allowing an attacker to create a new administrator account or take over existing accounts and steal their 2FA secrets.

Technologies: [Bubka 2FAuth](https://junglewise.ai/threats/technologies/2fauth). Vendors: [Bubka](https://junglewise.ai/threats/vendors/bubka).

## Quick answers

**Is CVE-2026-63438 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63438 being exploited in the wild.

**How severe is CVE-2026-63438?** Critical severity, with a CVSS score of 9.8, published 6 November 2026.

**Which products and versions are affected?** Bubka 2FAuth before 8.0.0.

**Is there a fix for CVE-2026-63438?** Yes: fixed in 8.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63438 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-63438?** Check whether you run Bubka 2FAuth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.0.0

## Technical details

The vulnerability exists in the RemoteUserProvider::retrieveById() method when AUTHENTICATION_GUARD is set to reverse-proxy-guard. The ReverseProxyGuard fails to validate that incoming authentication headers originated from a trusted proxy, allowing unauthenticated remote clients to forge authentication claims. On a fresh instance, this results in automatic promotion of the first created account to administrator; on existing instances, attackers can impersonate users and modify their email address to redirect password resets or 2FA secret exfiltration.

## Affected products

- Bubka 2FAuth before 8.0.0

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8](https://github.com/Bubka/2FAuth/commit/43873cbfba445926c7008b4291eeee67752af9e8)
- [https://github.com/Bubka/2FAuth/commit/8a4c395cac97f8b70b4a822639a6ad8a816f927c](https://github.com/Bubka/2FAuth/commit/8a4c395cac97f8b70b4a822639a6ad8a816f927c)

## Related threats

- [2FAuth SSRF via unrecognized IPv6 NAT64 prefixes](https://junglewise.ai/threats/cve-2026-63441-2fauth-is-a-web-app-to-manage-two-factor-authentication-2fa)
- [2FAuth SSRF via DNS rebinding in otpauth image fetch](https://junglewise.ai/threats/cve-2026-63440-2fauth-is-a-web-app-to-manage-two-factor-authentication-2fa)
- [2FAuth reverse proxy authentication bypass](https://junglewise.ai/threats/cve-2026-63439-2fauth-is-a-web-app-to-manage-two-factor-authentication-2fa)
- [2FAuth missing authorization on share recipients endpoint](https://junglewise.ai/threats/cve-2026-63437-2fauth-is-a-web-app-to-manage-two-factor-authentication-2fa)