{"id":"CVE-2023-54391","published":"2026-09-01T21:59:12Z","modified":"2026-10-01T15:19:44Z","title":"Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter","vendor":"Proxmox Server Solutions GmbH","product":"Proxmox Virtual Environment (VE)","tier":"core","eol":null,"affectedVersions":[{"vendor":"Proxmox Server Solutions GmbH","product":"Proxmox Virtual Environment (VE)","versions":[">= 7.0, <= 7.4","8.0"]}],"description":{"text":"Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.","provenance":"source","from":"CVE.org"},"summary":{"text":"The authentication flaw is in libpve-access-control before 8.0.4, a component of Proxmox Virtual Environment (VE) versions 7.0 through 8.0, where the login handling wrongly lets a request bypass password verification. An unauthenticated remote attacker who sends a POST request to the access ticket API endpoint with an arbitrary value in the tfa-challenge parameter can log in as any existing enabled user that has no second factor configured, including root@pam, with no password, no prior authentication, and no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:13Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03023,"percentile":0.87424,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-09-01","exploitedFirstSeen":"2026-09-01","ransomware":true,"evidence":[{"url":"https://forum.proxmox.com/threads/proxmox-ve-7-is-vulnerable-to-some-type-of-0day-rce-non-auth.186078/","date":"2026-09-01"},{"url":"https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929","date":"2026-09-01"},{"url":"https://core-jmp.org/2026/09/proxmox-ve-auth-bypass-cve-2023-54391/","date":"2026-09-02"},{"url":"https://previdian.com/CVE-2023-54391","date":"2026-09-02"},{"url":"https://www.crowdsec.net/vulntracking-report/cve-2023-54391-proxmox-ve-authentication-bypass","date":"2026-09-07"},{"url":"https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation","date":"2026-09-21"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation","url":"https://otx.alienvault.com/pulse/6ab4b65abfa49bffd54d1993","created":"2026-09-24"},{"name":"Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation","url":"https://otx.alienvault.com/pulse/6ab2691621023818faaf620e","created":"2026-09-22"}],"provenance":"machine"},"cwes":[{"id":"CWE-304","name":"Missing Critical Step in Authentication"}],"references":[{"url":"https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929","tags":["vendor-advisory"]},{"url":"https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=032e7d6d441f89a48cadfd7f47e957c8a561c022","tags":["patch"]},{"url":"https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=0f3d14d6be4d9f23e511701696a529ef3b7ffd61","tags":[]},{"url":"https://www.vulncheck.com/advisories/proxmox-ve-authentication-bypass-via-tfa-challenge-parameter","tags":["third-party-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-60613","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-60613","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2026-09-03","earliestUrl":"https://github.com/disqualifier/psa-2026-00043-recovery","repos":[{"name":"alexand0www/CVE-2023-54391-RCE","url":"https://github.com/alexand0www/CVE-2023-54391-RCE","stars":2,"created":"2026-10-06"},{"name":"disqualifier/psa-2026-00043-recovery","url":"https://github.com/disqualifier/psa-2026-00043-recovery","stars":0,"created":"2026-09-03"}]},"nuclei":[{"id":"CVE-2023-54391","name":"Proxmox VE - Default Credentials with TFA Bypass","severity":"critical","path":"http/cves/2023/CVE-2023-54391.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-54391.yaml"}],"first":{"date":"2026-09-03","source":"PoC-in-GitHub","url":"https://github.com/disqualifier/psa-2026-00043-recovery"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-09-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-54391","provenance":"source"},{"date":"2026-09-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://forum.proxmox.com/threads/proxmox-ve-7-is-vulnerable-to-some-type-of-0day-rce-non-auth.186078/","provenance":"source"},{"date":"2026-09-03","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/disqualifier/psa-2026-00043-recovery","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":85.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 59 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":17.48,"detail":"percentile 0.8742"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}