Bubka vulnerabilities
We track 5 vulnerabilities in Bubka products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Bubka vulnerabilities
- 8.1 High severity
2FAuth: Weak Password Recovery Mechanism for Forgotten Password
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, captur
- 9.8 Critical severity
2FAuth: Improper Authentication
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a cu
- 9.8 Critical severity
2FAuth: Improper Authentication
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, Remo
- 9.1 Critical severity
2FAuth: Server-Side Request Forgery
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal ne
- 7.5 High severity
2FAuth: Server-Side Request Forgery
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows