CVE-2026-63437
2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/recipients for accounts owned by other users, enumerate registered user IDs and display names, test exact email addresses with filter[nameOrEmail], and inspect each account's sharing relationships. This issue is fixed in version 8.0.0.
| CWE | CWE-639 CWE-862 |
| Vendor | bubka |
| Product | 2fauth |
| Published | Nov 6, 2026 |
Get instant alerts for bubka 2fauth
Be the first to know when new medium vulnerabilities affecting bubka 2fauth are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N