Description
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Bubka | 2FAuth | < 9.0.1 | 9.0.1 |
References
- GitHub Security Advisory (GHSA-v9qw-r94g-95qv) vendor-advisory
- https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3 patch
- 2FAuth v9.0.1 Release Notes release-notes
- https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47 technical-description
- https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64 technical-description
- VulnCheck Advisory: 2FAuth before 9.0.1 Password Reset Poisoning via Host Header third-party-advisory