CVE-2026-32133 is a Server-Side Request Forgery (SSRF) vulnerability classified under CWE-918, found in Bubka's 2FAuth web application, which manages Two-Factor Authentication (2FA) accounts and generates security codes. The vulnerability exists in versions prior to 6.1.0 and arises because the application fails to properly validate the 'image' parameter in OTP URLs against internal or private IP addresses before making HTTP requests. While a prior patch introduced response validation to ensure only valid images are stored, the server still performs HTTP requests to arbitrary URLs before this validation step, enabling blind SSRF exploitation. This flaw allows unauthenticated attackers to coerce the server into sending HTTP requests to internal network resources or cloud provider metadata endpoints, potentially exposing sensitive information or enabling further internal network attacks. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk profile. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, but with high scope and impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild, but the vulnerability is publicly disclosed and fixed in version 6.1.0.

The SSRF vulnerability in 2FAuth can have significant impacts on organizations using affected versions. Attackers can leverage it to access internal network resources that are otherwise inaccessible externally, including sensitive backend services, databases, or administrative interfaces. Access to cloud metadata endpoints can allow attackers to retrieve credentials or tokens, facilitating further compromise of cloud infrastructure. This can lead to data breaches, unauthorized access, lateral movement within networks, and disruption of authentication services. Since 2FAuth manages 2FA accounts, compromise could undermine multi-factor authentication security, increasing risk of account takeover. The vulnerability's ease of exploitation without authentication or user interaction broadens the attack surface, making it a critical risk for organizations relying on this software for secure authentication management.

Organizations should immediately upgrade Bubka 2FAuth to version 6.1.0 or later, where this SSRF vulnerability is fixed. Until upgrade is possible, administrators should implement network-level controls to restrict the server's outbound HTTP requests, especially to internal IP ranges and cloud metadata service IPs (e.g., 169.254.169.254 for AWS). Employ web application firewalls (WAFs) with rules to detect and block SSRF patterns targeting the image parameter. Conduct thorough input validation and sanitization on all URL parameters, enforcing strict allowlists for external URLs. Monitor logs for unusual outbound requests from the 2FAuth server. Additionally, review and harden cloud instance metadata service access policies, such as enabling IMDSv2 or equivalent protections to reduce risk if SSRF is exploited. Regularly audit and update dependencies and configurations to minimize exposure.