CVE-2026-127088

HIGH 8.1

2FAuth before 9.0.1 Password Reset Poisoning via Host Header

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.

CWE	CWE-640
Vendor	bubka
Product	2fauth
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for bubka 2fauth

Be the first to know when new high vulnerabilities affecting bubka 2fauth are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Bubka / 2FAuth

0 < 9.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv github.com: https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3 github.com: https://github.com/Bubka/2FAuth/releases/tag/v9.0.1 github.com: https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47 github.com: https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64 vulncheck.com: https://www.vulncheck.com/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header

Credits

Sandipkumar sah