Is CVE-2026-63441 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63441 being exploited in the wild.

How severe is CVE-2026-63441?

Informational severity, published 6 November 2026.

Which products and versions are affected?

Bubka 2FAuth 6.1.0 to 8.0.0 (exclusive).

How is CVE-2026-63441 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-63441?

Check whether you run Bubka 2FAuth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63441: 2FAuth SSRF via unrecognized IPv6 NAT64 prefixes

CVE-2026-63441 · Severity: info · Published 2026-11-06

2FAuth is a web application that manages two-factor authentication accounts and generates security codes. A vulnerability in versions 6.1.0 through 8.0.0 allows attackers to bypass URL validation and access internal systems by crafting specially formatted IPv6 addresses that route to private or metadata endpoints. An account holder or external attacker can exploit this to probe internal endpoints or retrieve sensitive resources when image fetching is enabled.

Technologies: Bubka 2FAuth. Vendors: Bubka.

Quick answers

Is CVE-2026-63441 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63441 being exploited in the wild.
How severe is CVE-2026-63441?: Informational severity, published 6 November 2026.
Which products and versions are affected?: Bubka 2FAuth 6.1.0 to 8.0.0 (exclusive).
Is there a fix for CVE-2026-63441?: Yes: fixed in 8.0.0. Until then: Disable image fetching in 2FAuth configuration if NAT64 translation is available in your network environment, or restrict image fetch requests to a whitelist of explicitly trusted domains. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63441 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-63441?: Check whether you run Bubka 2FAuth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.0.0

Disable image fetching in 2FAuth configuration if NAT64 translation is available in your network environment, or restrict image fetch requests to a whitelist of explicitly trusted domains.

Technical details

The ValidatesUrls::isPublicIp() method fails to recognize RFC 6052 (64:ff9b::/96) and RFC 8215 (64:ff9b:1::/48) NAT64 prefixes, allowing an attacker to embed private or link-local IPv4 addresses within IPv6 literals that pass validation. When IconService::buildFromRemoteImage() processes an otpauth URI with a malicious image parameter, it performs an unvalidated HTTP GET request, enabling SSRF attacks against internal endpoints including cloud metadata services in NAT64-enabled deployments.

Affected products

Bubka 2FAuth 6.1.0 to 8.0.0 (exclusive)

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.