CVE-2026-63440
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
52/100
Published: 2026-11-06
Modified: 2026-11-12
First seen: 2026-11-06
Status: active
Attack Surface
Network
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
Low
A:
None
Description
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validation and an internal address during the later connection, bypassing the private-address deny list to reach loopback, private-network, link-local, or cloud metadata endpoints. This issue is fixed in version 8.0.0.
Weakness Classification (2)
References & Advisories (3)
x_refsource_MISC
x_refsource_MISC
x_refsource_CONFIRM