CVE-2023-54391

Received Received - Intake

Authentication Bypass in Proxmox Virtual Environment

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2023-54391

Affected Vendors & Products

Vendor	Product	Version / Range
proxmox	virtual_environment	From 7.0 (inc) to 8.0 (inc)
proxmox	virtual_environment	From 8.0 (inc) to 8.0.4 (inc)
proxmox	libpve_access_control	to 8.0.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-304	The product implements an authentication technique, but it skips a step that weakens the technique.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication bypass in Proxmox Virtual Environment (VE) versions 7.0 through 8.0. It exists in the libpve-access-control component before version 8.0.4. An unauthenticated attacker can exploit it by sending a POST request to the access ticket API endpoint with an arbitrary tfa-challenge value, which skips password verification entirely. This allows attackers to authenticate as any enabled user, including the privileged root@pam account, without needing the correct password or second-factor authentication.

Detection Guidance

This vulnerability allows unauthenticated access by bypassing authentication via the tfa-challenge parameter in Proxmox VE's API login endpoint. To detect it, monitor API access logs for POST requests to /access/ticket with arbitrary tfa-challenge values. Check for successful logins without prior password verification or second factor prompts.

Impact Analysis

If you use Proxmox VE versions 7.0 to 8.0, an attacker could gain full administrative access to your virtual environment without needing valid credentials. This could lead to unauthorized control over virtual machines, data theft, service disruption, or further compromise of your infrastructure. The impact is severe as it affects all enabled users, including the highest privilege account.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. A successful exploit could result in data breaches, violating these regulations and potentially leading to legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade libpve-access-control to version 8.0.4 or later to patch the authentication bypass vulnerability. If using Proxmox VE 7.0 through 8.0, apply the latest security updates immediately. Disable unauthenticated API access if possible and review user accounts for unauthorized access.

Hi! I’m here to help you understand CVE-2023-54391. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70