CVE-2023-54391

The record

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

Affected packages

Related vulnerabilities

• CVE-2026-76207 phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where… CWE-304
• CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. CWE-304
• CVE-2026-61143 Vulnerability in the Oracle Communications Convergent Charging Controller product of… CWE-304
• CVE-2026-57915 It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending… CWE-304
• CVE-2026-44547 ChurchCRM is an open-source church management system. CWE-304
• CVE-2026-42452 Termix is a web-based server management platform with SSH terminal, tunneling, and file… CWE-304
• CVE-2026-40542 Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to… CWE-304
• CVE-2026-30831 Rocket.Chat is an open-source, secure, fully customizable communications platform. CWE-304