CVE-2026-63438 | Bubka 2FAuth up to 7.x RemoteUserProvider retrieveById access control

A vulnerability was found in Bubka 2FAuth up to 7.x. It has been declared as critical. The affected element is the function RemoteUserProvider::retrieveById of the component RemoteUserProvider. Executing a manipulation can lead to improper access controls.

This vulnerability is registered as CVE-2026-63438. It is possible to launch the attack remotely. No exploit is available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More