CVE-2023-54391

CRITICAL 9.8CVE-2023-54391 · Published 01/09/2026 · updated 08/09/2026

In short

CVE-2023-54391 is a CRITICAL (CVSS 9.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 3.0%, higher than 87.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free