CVE-2026-32133: 2FAuth Blind SSRF Vulnerability

CVE-2026-32133 Overview

CVE-2026-32133 is a blind Server-Side Request Forgery (SSRF) vulnerability affecting 2FAuth, a web application designed to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to version 6.1.0, authenticated users could exploit this vulnerability to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints.

The vulnerability exists because the image parameter in OTP URLs is not properly validated for internal or private IP addresses before HTTP requests are made. While a previous security fix added response validation to ensure only valid images are stored, the HTTP request is still executed to arbitrary URLs before this validation occurs, enabling attackers to probe internal infrastructure.

Critical Impact

Authenticated attackers can leverage this blind SSRF to access cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), scan internal network services, and potentially exfiltrate sensitive credentials or infrastructure information from the server's network perspective.

Affected Products

• 2FAuth versions prior to 6.1.0

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-32133 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-32133

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery), a web application vulnerability type where an attacker can induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing.

In the context of 2FAuth, the application processes OTP (One-Time Password) URLs which can include an image parameter for visual identification of accounts. When a user submits an OTP URL containing this image parameter, the server fetches the image from the specified URL to cache or validate it. The critical flaw lies in the absence of proper URL validation against internal and private IP address ranges before the HTTP request is initiated.

An authenticated attacker can craft a malicious OTP URL with an image parameter pointing to internal resources such as:

• Cloud provider metadata endpoints (169.254.169.254)
• Internal web services (http://192.168.x.x/admin)
• Localhost services (http://127.0.0.1:8080)

While the application does perform post-request validation to ensure the response is a valid image, the HTTP request itself has already been sent by this point, allowing attackers to probe internal infrastructure, trigger actions on internal services, or exfiltrate data through DNS or timing-based side channels.

Root Cause

The root cause of this vulnerability is insufficient input validation on the image URL parameter within OTP URLs. The application fails to implement a pre-request allowlist or blocklist mechanism to filter out requests to internal IP ranges, private networks, and cloud metadata services. The validation logic that exists only executes after the HTTP request has completed, making it ineffective at preventing SSRF attacks.

Attack Vector

The attack vector is network-based, requiring an authenticated user session within the 2FAuth application. An attacker with valid credentials can submit specially crafted OTP URLs through the application's normal functionality. The server processes these URLs and makes outbound HTTP requests to attacker-controlled destinations or internal targets.

The attack flow involves the authenticated user creating or importing an OTP account with a malicious image URL pointing to an internal service. The server then makes an HTTP request to retrieve the image. Even though the response may be rejected as an invalid image, the request itself reveals information about internal network topology, accessible services, and potentially sensitive data depending on the targeted endpoint.

Detection Methods for CVE-2026-32133

Indicators of Compromise

• Unusual outbound HTTP requests from the 2FAuth server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• HTTP requests to cloud metadata endpoints (169.254.169.254) from the application server
• Abnormal DNS queries from the server resolving internal hostnames or attacker-controlled domains
• OTP account entries with suspicious or malformed image URLs pointing to non-standard destinations

Detection Strategies

• Implement network monitoring to detect outbound connections from web application servers to internal IP ranges that should not be accessed
• Deploy web application firewall (WAF) rules to inspect and block OTP URL submissions containing internal IP addresses or metadata endpoint references
• Enable comprehensive logging of all outbound HTTP requests made by the 2FAuth application with source, destination, and response codes
• Monitor for authentication anomalies combined with suspicious OTP account creation patterns

Monitoring Recommendations

• Configure alerts for any HTTP traffic from the 2FAuth server to RFC 1918 private IP ranges or link-local addresses
• Establish baseline outbound request patterns and alert on deviations, particularly to uncommon ports or protocols
• Implement DNS query logging to identify potential data exfiltration through DNS-based SSRF techniques
• Review application logs for repeated failed image fetches which may indicate SSRF probing attempts

How to Mitigate CVE-2026-32133

Immediate Actions Required

• Upgrade 2FAuth to version 6.1.0 or later immediately to apply the security patch
• Audit existing OTP accounts for any suspicious image URLs pointing to internal addresses or metadata endpoints
• Review server access logs for evidence of exploitation attempts prior to patching
• Consider implementing network-level egress filtering to prevent the application server from connecting to internal resources

Patch Information

This vulnerability is fixed in 2FAuth version 6.1.0. The patch implements proper URL validation before HTTP requests are initiated, blocking requests to internal IP ranges, private networks, and cloud metadata endpoints. Organizations should update to this version or later through their normal update channels. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Deploy network-level controls to block outbound requests from the 2FAuth server to internal IP ranges and metadata endpoints
• Configure a reverse proxy or WAF to inspect and sanitize OTP URL submissions before they reach the application
• Restrict which users have permission to create or import OTP accounts until the patch can be applied
• Implement egress firewall rules allowing the application server to only connect to known-good external image hosting services

# Example iptables egress filtering configuration
# Block outbound access to cloud metadata endpoints
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block outbound access to private IP ranges from web application
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP