CVE-2026-32133

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32133", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T22:19:36.546Z", "datePublished": "2026-03-11T21:45:09.034Z", "dateUpdated": "2026-03-12T16:17:42.667Z"}, "containers": {"cna": {"title": "2FAuth has Blind SSRF in image parameter allows internal network access and more", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8"}], "affected": [{"vendor": "Bubka", "product": "2FAuth", "versions": [{"version": "< 6.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T21:45:09.034Z"}, "descriptions": [{"lang": "en", "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0."}], "source": {"advisory": "GHSA-8qp3-x2mp-j6f8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T14:54:28.865284Z", "id": "CVE-2026-32133", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T16:17:42.667Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32133", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T14:54:28.865284Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T14:55:29.254Z"}}], "cna": {"title": "2FAuth has Blind SSRF in image parameter allows internal network access and more", "source": {"advisory": "GHSA-8qp3-x2mp-j6f8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "Bubka", "product": "2FAuth", "versions": [{"status": "affected", "version": "< 6.1.0"}]}], "references": [{"url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8", "name": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T21:45:09.034Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32133", "state": "PUBLISHED", "dateUpdated": "2026-03-12T16:17:42.667Z", "dateReserved": "2026-03-10T22:19:36.546Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T21:45:09.034Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "2FAuth", "vendor": "Bubka", "versions": [{"status": "affected", "version": "< 6.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:*", "matchCriteriaId": "AEBD8E7A-4FB9-4BF4-829E-BBEEAEFE427A", "versionEndExcluding": "6.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0."}, {"lang": "es", "value": "2FAuth es una aplicaci\u00f3n web para gestionar cuentas de Autenticaci\u00f3n de Dos Factores (2FA) y generar sus c\u00f3digos de seguridad. Antes de la versi\u00f3n 6.1.0, existe una vulnerabilidad SSRF ciega en 2FAuth que permite a los usuarios autenticados realizar solicitudes HTTP arbitrarias desde el servidor a redes internas y puntos finales de metadatos en la nube. El par\u00e1metro 'image' en la URL de OTP no se valida correctamente para direcciones IP internas / privadas antes de realizar solicitudes HTTP. Aunque la correcci\u00f3n anterior a\u00f1adi\u00f3 validaci\u00f3n de respuesta para asegurar que solo se almacenaran im\u00e1genes v\u00e1lidas, la solicitud HTTP a\u00fan se realiza a URLs arbitrarias antes de que ocurra esta validaci\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 6.1.0."}], "id": "CVE-2026-32133", "lastModified": "2026-06-17T10:35:11.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32133", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T14:54:28.865284Z", "version": "2.0.3"}}]}, "published": "2026-03-11T22:16:33.273", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "2FAuth", "source": "cna", "vendor": "Bubka"}, "product": "2fauth", "vendor": "bubka"}], "analysis": {"en": {"generated_at": "2026-03-17T16:18:39.835552+00:00", "value": {"mitigation_remediation": ["Upgrade 2FAuth to version 6.1.0 or later"], "summary": {"action": "Apply Patch", "impact": "Internal Network Access via Blind SSRF"}, "threat_synthesis": {"affected_systems": "The affected product is 2FAuth by Bubka. All releases prior to 6.1.0 are vulnerable; the fix was introduced in 6.1.0. Specific vendors and CPEs impacted include the Bubka:2FAuth product listed as cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:*.", "description_and_impact": "2FAuth, a web application for managing Two-Factor Authentication accounts, contains a blind Server Side Request Forgery vulnerability in the image parameter of OTP URLs. An authenticated user can supply a URL that is not properly validated for private or internal IP addresses, causing the server to perform an HTTP request to that URL before validating the response. This flaw allows attackers to reach internal resources, cloud metadata services, or other confidential endpoints that are normally shielded from the public internet. The vulnerability is categorized as CWE-918, indicating the potential for remote data exfiltration and internal network discovery, thereby threatening the confidentiality and integrity of internal systems.", "risk_and_exploitability": "The CVSS score of 7.8 indicates a high severity, but the EPSS score of <1% suggests a low likelihood of exploitation at any given time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with 2FAuth, and the attacker can make arbitrary HTTPS or HTTP requests to internal IPs or cloud metadata endpoints, but due to the blind nature of the SSRF, the attacker gains no immediate response information. Nonetheless, the ability to reach internal services can be leveraged for further attacks. The attack vector is authenticated and remote from the attacker\u2019s perspective, via the web application."}}}}, "created": "2026-03-12T09:55:40.565156+00:00", "updated": "2026-03-20T15:36:49.079116+00:00", "vendors": ["bubka", "bubka$PRODUCT$2fauth"]}