Security Resilience

CVE-2026-32133

SSRF in 2Fauth ≤ 6.1.0

Public PoCSSRF
Published
11 March 2026
Modified
13 March 2026
Patch / advisory
View advisory
CVSS Score v4 7.8
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0054 44th percentile
Risk Priority 43 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-32133 is a high-severity SSRF (CWE-918) vulnerability in 2Fauth 2Fauth. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-32133 is a blind server-side request forgery (SSRF) vulnerability in 2FAuth, a web application for managing two-factor authentication (2FA) accounts and generating security codes. The issue affects versions prior to 6.1.0 and stems from improper validation of the image parameter in OTP URLs, which allows HTTP requests to arbitrary destinations, including internal or private IP addresses, before any response validation occurs. A prior fix had introduced response checks to ensure only valid images are stored, but it did not prevent the initial requests. The vulnerability is classified under CWE-918 with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Authenticated users can exploit this vulnerability to initiate arbitrary HTTP requests from the 2FAuth server to internal networks and cloud metadata endpoints. This enables attackers with server access to scan or interact with resources inaccessible from the public internet, potentially leading to high confidentiality and integrity impacts as indicated by the CVSS score.

The vulnerability is addressed in 2FAuth version 6.1.0. Additional details are available in the security advisory at https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal…

more

networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1584 Compromise Infrastructure Resource Development
Adversaries may compromise third-party infrastructure that can be used during targeting.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-52598Same product: 2Fauth 2Fauth
CVE-2024-52597Same product: 2Fauth 2Fauth
CVE-2023-36816Same product: 2Fauth 2Fauth
CVE-2025-45731Same product: 2Fauth 2Fauth
CVE-2025-14627Shared CWE-918
CVE-2026-26286Shared CWE-918
CVE-2026-32301Shared CWE-918
CVE-2026-26120Shared CWE-918
CVE-2026-81357Shared CWE-918
CVE-2026-16600Shared CWE-918

Affected Assets

2fauth
2fauth
≤ 6.1.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.6
  • V1.5.3
  • V5.3.2
  • V10.4.7

Mitigating Controls (NIST 800-53 r5) AI

AC-4 Information Flow Enforcement good match

Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.

SI-10 Information Input Validation good match

Input validation directly stops untrusted URLs from being accepted and fetched without destination checks.

SC-7 Boundary Protection partial match

Boundary protection limits the network reach of server-initiated requests even if SSRF occurs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
blocks

Secure development practices directly include input validation and destination allow-listing that prevent SSRF.

DE.CM-09 partial match
blocks

Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.

ID.RA-01 partial match
blocks

Vulnerability identification processes can discover and record SSRF flaws in web applications.

PR.IR-01 partial match
blocks

Network segmentation and egress controls can limit the damage from successful SSRF requests.

References