Is CVE-2026-32133 actively exploited?

No active exploitation of CVE-2026-32133 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32133 be exploited remotely?

Yes. CVE-2026-32133 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32133?

CVE-2026-32133 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2026-32133

CRITICAL

CVE-2026-32133

CWE-918Published: March 11, 2026· Updated: Mar 13, 2026

9.1

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:10.3th

Official Description

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0.

NVD Source

Technical Analysis

CVE-2026-32133 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.