CVE-2026-127088 json
2FAuth before 9.0.1 Password Reset Poisoning via Host Header
published 13d ago modified yesterday also EUVD-2026-125094 , GHSA-v9qw-r94g-95qv
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository Bubka/2FAuth. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.
Patch / fix
- Bubka 2FAuth 9.0.1
Is CVE-2026-127088 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- yesterday
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- Bubka 2FAuth
Classification
- Weakness
-
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
References
-
github.com
/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3
patch
-
github.com
/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv
vendor-advisory, advisory
-
github.com
/Bubka/2FAuth/releases/tag/v9.0.1
release-notes
-
github.com
/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47
technical-description
-
github.com
/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64
technical-description
-
vulncheck.com
/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header
third-party-advisory
Sources
- CVE List CVE-2026-127088
- NVD CVE-2026-127088
- Maintainer advisory GHSA-v9qw-r94g-95qv
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of Bubka/2FAuth published their own advisory on GitHub. Reviewed sources take precedence over it.