Skip to content
CVSS 9.8 · CRITICAL

CVE-2023-54391Critical Authentication Bypass in Proxmox VE

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

View on NVD

Analysis

A critical authentication bypass in Proxmox Virtual Environment (VE) 7.0 through 8.0 allows attackers to skip password verification and log in as any user, including root, by providing a dummy challenge value. This vulnerability applies to accounts without MFA configured and provides full control over the virtualization host.

Relevant roles

LinuxCloudciberseguridadDockerBackend

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-304

EPSS

No EPSS score yet (CVE may be too fresh).

Technical description

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

Published: 9/1/2026, 10:17:10 PM
Last modified: 9/1/2026, 10:17:10 PM

References

HomeEventsBlogResourcesCoursesTeam