CVE-2026-32133 is a blind server-side request forgery in 2FAuth, the self-hosted two-factor code manager, scored 9.1. The image parameter in an OTP URL was fetched without checking for internal addresses. Upgrade to 2FAuth 6.1.0 or later. Checks and steps follow below.
What's affected
2FAuth 5.6.1 and earlier per the advisory, with 6.1.0 listed as the patched version. The record describes the flaw as present before 6.1.0.
It needs a logged in user. The advisory says an earlier fix validated the response so only valid images are stored, but the request to the arbitrary address was still sent before that validation.
How to check if you're exposed
Find the version of your 2FAuth deployment from the release or image tag you run. Anything earlier than 6.1.0 is in scope.
Then think about what the server can reach. Cloud instances may expose a metadata service on a link local address, and home labs often have admin interfaces on internal addresses. A blind SSRF does not return the response, but it can still trigger actions or confirm what exists.
What to do now
- Upgrade 2FAuth to 6.1.0 or later.
- Limit outbound connections from the 2FAuth host to what it needs, and block access to the cloud metadata address.
- On cloud hosts, require the more protected version of the metadata service where your provider offers it.
- Review accounts, and remove users who do not need access.
Why it matters
The class is CWE-918, server-side request forgery. The application fetched a URL taken from user supplied data before deciding whether the target was acceptable. Checking the response afterward does not undo the request.
A tool that holds two factor secrets deserves careful hosting. Even a blind SSRF can be used to probe internal services, so network controls around the host matter as much as the patch.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What does blind mean here?
The server makes the request but the attacker does not see the answer. It can still cause effects or confirm that an internal address exists.
Is egress filtering worth it?
Yes. It limits what any SSRF can reach, now and in future.
Sources
Last reviewed: 19 October 2026.
