2FAuth missing access checks and authentication bypass
Other people's accounts in this two-factor code web app can be breached!
Summary
A logged-in user of the 2FAuth two-factor code manager web app can peek at other people's account sharing details, and with reverse-proxy login a forged header lets an attacker sign in as another user. Versions before 8.0.0 are affected, and a fresh instance can be taken over by an unauthenticated attacker who creates an administrator.
Affected when
- account sharing enabled
- external otpauth image fetching enabled
- AUTHENTICATION_GUARD=reverse-proxy-guard set and app reachable directly
What to do
Update 2FAuth to version 8.0.0.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen