CVE-2026-127088

EUVD-2026-125094
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 46.01%
Common Weakness Enumeration
References
https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47
https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64
https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3
https://github.com/Bubka/2FAuth/releases/tag/v9.0.1
https://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv
https://www.vulncheck.com/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header