CVE-2026-63440 | Bubka 2FAuth up to 7.x Image Fetch isExternalHost server-side request forgery

November 6, 2026 Yanac

A vulnerability was found in Bubka 2FAuth up to 7.x. It has been rated as critical. The impacted element is the function ValidatesUrls::isExternalHost of the component Image Fetch. The manipulation leads to server-side request forgery.

This vulnerability is documented as CVE-2026-63440. The attack can be initiated remotely. There is not any exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More