{"id":"CVE-2026-127088","aliases":["GHSA-v9qw-r94g-95qv"],"url":"https://o3.security/vulnerability/CVE-2026-127088","summary":"2FAuth before 9.0.1 Password Reset Poisoning via Host Header","details":"2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, capture the victim's token, and take over accounts exposing stored TOTP/HOTP secrets.","published":"2026-11-13T09:34:16.098Z","modified":"2026-11-14T10:30:37.646265493Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3","label":"Bubka/2FAuth@35ce085"},"references":[{"type":"PACKAGE","url":"https://github.com/Bubka/2FAuth"},{"type":"ARTICLE","url":"https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Http/Kernel.php#L47"},{"type":"ARTICLE","url":"https://github.com/Bubka/2FAuth/blob/v9.0.0/app/Notifications/WebauthnRecoveryNotification.php#L62-L64"},{"type":"FIX","url":"https://github.com/Bubka/2FAuth/commit/35ce085b69f9f5044dfb94017c3f27c1dc2668f3"},{"type":"ADVISORY","url":"https://github.com/Bubka/2FAuth/releases/tag/v9.0.1"},{"type":"ADVISORY","url":"https://github.com/Bubka/2FAuth/security/advisories/GHSA-v9qw-r94g-95qv"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127088.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127088"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/2fauth-before-9.0.1-password-reset-poisoning-via-host-header"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-14T10:30:37.646265493Z"}}