Cyber & AI intelligence
Wasteland.
Briefs indexed2363
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2023-54391 2026-09-01

CVE-2023-54391: Proxmox VE Authentication Bypass via tfa-challenge Parameter

"A critical authentication bypass in Proxmox Virtual Environment can let unauthenticated attackers log in as any enabled user that has no second factor configured, potentially including `root@pam`, by supplying an…"

A critical authentication bypass in Proxmox Virtual Environment can let unauthenticated attackers log in as any enabled user that has no second factor configured, potentially including root@pam, by supplying an arbitrary tfa-challenge value to the API login endpoint.

What Is It

CVE-2023-54391 is an authentication bypass (CWE-304: Missing Critical Step in Authentication) in libpve-access-control, the access control component of Proxmox Virtual Environment. An attacker sends a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter, which causes password verification to be skipped entirely. The result is a valid session as any existing enabled user that does not have a configured second factor.

The flaw carries a CVSS v3.1 base score of 9.8 (CRITICAL, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 score of 9.3 (CRITICAL). It is remotely reachable, requires no privileges, no user interaction, and is low complexity.

Why It Matters

Proxmox VE is a hypervisor management platform; compromising it means control over the virtual machines and containers it hosts. Where root@pam has no second factor configured, a single unauthenticated HTTP request against an exposed management interface could hand an attacker full administrative control of the host. CVE-2023-54391 is not listed in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed as of publication.

What's Vulnerable

Only accounts without a configured second factor are reachable via this bypass. The CVE is tagged unsupported-when-assigned, all affected releases are end of life.

Patch Status

The fix landed in libpve-access-control 8.0.4; the upstream change is published in the pve-access-control git repository (commit 032e7d6d). Because every affected release is end of life, operators should upgrade to a currently supported Proxmox VE release rather than relying on a backport. Until then, restrict network exposure of the management API and ensure two-factor authentication is configured where possible.

Sources