CVE-2026-32133 2FAuth has Blind SSRF in image parameter allows internal network access and more
Authenticated users can exploit blind SSRF in 2FAuth to access internal networks and cloud metadata endpoints via the image parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-32133?
CVE-2026-32133 is a high-severity server-side request forgery vulnerability in Bubka 2FAuth, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-32133?
It affects 1 product.
Products include 2fauth 2fauth.
How do I fix CVE-2026-32133?
No fix has been published for CVE-2026-32133 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-32133 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32133 exists.
Other vulnerabilities in Bubka 2FAuth
- CVE-2024-52598 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview
- CVE-2025-45731 Race condition in n/a
- CVE-2024-52597 2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render
- CVE-2023-36816 Cross-Site Scripting (XSS) at Account creation in 2FAuth
Sources
Also known as GHSA-8qp3-x2mp-j6f8.