Vulnerability · Published Sep 1, 2026 · Assigned by VulnCheck
CVE-2023-54391Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
Critical 9.8
In plain English
A critical-severity security flaw in Proxmox Virtual Environment (VE) from Proxmox Server Solutions GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Proxmox Server Solutions GmbH | Proxmox Virtual Environment (VE) | 7.0 – through 7.48.0 |
Weakness: CWE-304 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- Vendor Advisory vendor-advisory
- Patch Commit patch
- Introducing Commit
- https://www.vulncheck.com/advisories/proxmox-ve-authentication-bypass-via-tfa-challenge-parameter third-party-advisory