Threats affecting pkg:github/2FAuth

Bubka 2FAuth versions before 9.0.1 have a weak password recovery mechanism that allows unauthenticated attackers to manipulate password reset links via the HTTP Host header. This vulnerability enables attackers to request recovery emails with attacker-controlled hosts, potentially capturing victim tokens and taking over accounts with stored TOTP/HOTP secrets.