What is the CVSS score of CVE-2026-32133?

CVE-2026-32133 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of 2fauth are affected by CVE-2026-32133?

A critical vulnerability in 2FAuth (CVE-2026-32133) allows authenticated users to exploit the application to scan internal networks and access cloud metadata endpoints, potentially exposing sensitive…

How to fix or mitigate CVE-2026-32133?

Within 24 hours: Inventory all 2FAuth deployments, assess user access controls, and implement network-level restrictions on outbound HTTP/HTTPS from the 2FAuth server. Within 7 days: Deploy WAF rules to block requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, etc.) from the application, restrict 2FAuth functionality to essential users only, and audit access logs for suspicious activity. Within 30 days: Identify and evaluate alternative 2FA solutions, plan migration strategy, and monitor for vendor patch release while maintaining the interim controls.

2fauth CVE-2026-32133

CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-11 security-advisories@github.com

SSRF 2fauth

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:07 vuln.today

CVE Published

Mar 11, 2026 - 22:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0.