{"id":"CVE-2026-63441","published":"2026-11-06T21:17:10.307","lastModified":"2026-11-09T23:17:24.873","description":"2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\\Services\\Traits\\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled and a NAT64 translation path to the internal IPv4 target, an account holder can submit the crafted URI directly, or an external attacker can induce a victim to import a crafted URI or migration payload. IconService::buildFromRemoteImage() then issues an HTTP GET to the embedded target, allowing image-shaped responses to be recovered or other endpoints to be probed blindly. This issue is fixed in version 8.0.0.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Bubka/2FAuth/commit/df19e7533082671ecc2e0c735adcd51e93b1cb4c","tags":[]},{"url":"https://github.com/Bubka/2FAuth/releases/tag/v8.0.0","tags":[]},{"url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-wc8m-7c5g-xrrc","tags":[]}],"exploitRefs":[{"url":"https://github.com/Bubka/2FAuth/commit/df19e7533082671ecc2e0c735adcd51e93b1cb4c","tags":[]},{"url":"https://github.com/Bubka/2FAuth/releases/tag/v8.0.0","tags":[]},{"url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-wc8m-7c5g-xrrc","tags":[]}],"hasPoc":true,"ai":null}