CVE-2026-63439

Summary

A reverse proxy authentication bypass allows unauthenticated users to impersonate any existing user, including administrators, by forging a trusted identity header when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, leading to full compromise of 2FA secrets and administrative functions.

Exploitability

Exploitation is trivial for an attacker who can send direct HTTP requests to the application without going through a trusted reverse proxy; no authentication or user interaction is required.

Blast radius

Successful exploitation grants full access to all stored 2FA secrets, account management features, and administrative controls, enabling credential theft, lateral movement, and complete system takeover.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to 2FAuth version 8.0.0 or later, which fixes the vulnerability by validating that requests originate from configured trusted proxies before accepting the identity header.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.