CVE-2023-54391

CRITICAL 9.8

Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

CWE	CWE-304
Vendor	proxmox server solutions gmbh
Product	proxmox virtual environment (ve)
Published	Sep 1, 2026
Last Updated	Sep 1, 2026

Stay Ahead of the Next One

Get instant alerts for proxmox server solutions gmbh proxmox virtual environment (ve)

Be the first to know when new critical vulnerabilities affecting proxmox server solutions gmbh proxmox virtual environment (ve) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Proxmox Server Solutions GmbH / Proxmox Virtual Environment (VE)

7.0 ≤ 7.4 8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

forum.proxmox.com: https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929 git.proxmox.com: https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=032e7d6d441f89a48cadfd7f47e957c8a561c022 vulncheck.com: https://www.vulncheck.com/advisories/proxmox-ve-authentication-bypass-via-tfa-challenge-parameter

Credits

Kamil Rakowski Nathan Xavier Golez Sagnik Sasmal