Weak Password Recovery in 2FAuth Allows Account Takeover via Host Header Forgery

Executive Summary

CVE-2026-127088 is a high-severity vulnerability in 2FAuth versions before 9.0.1. It allows unauthenticated attackers to forge HTTP Host headers during password or WebAuthn recovery, poisoning reset links sent to victims. The malicious links appear legitimate but contain attacker-controlled domains while retaining valid reset tokens. When victims click these links, attackers capture the tokens and reset passwords, gaining full account control and access to stored TOTP/HOTP secrets.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious password reset or WebAuthn recovery email requests containing forged Host headers. Check 2FAuth logs for reset link generation with unexpected domains. Inspect email headers of recovery messages for tampered URLs. Use tools like Wireshark or tcpdump to capture HTTP requests to the 2FAuth instance and verify Host header values.

Useful 0 Not Useful 0

Impact Analysis

If you use 2FAuth before version 9.0.1, an attacker could trick you into clicking a malicious password reset link. This could let them take over your account, steal your two-factor authentication secrets (TOTP/HOTP), and bypass second-factor protection across all linked services. Attackers need your email address and you must click the link for the attack to succeed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles (Article 32) and HIPAA's security requirements for protected health information. Compromised accounts may expose personal data or health records, potentially resulting in regulatory fines, breach notifications, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade 2FAuth to version 9.0.1 or later immediately. Ensure TrustHosts middleware is enabled in Laravel configuration. Configure nginx to reject untrusted Host headers in Docker deployments. Disable password reset or WebAuthn recovery flows temporarily if upgrading is not possible. Monitor for unauthorized account access or token usage.

Useful 0 Not Useful 0