Skip to content
VulniPulse
Critical9.3Proxmox Updated

Critical [CVE-2023-54391] Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint

This critical-severity Proxmox advisory covers CVE-2023-54391 affecting Proxmox Virtual Environment (VE).

CVE-2023-54391 Published Sep 1, 2026Updated by vendor Sep 1, 2026
Affected products & platforms
ProxmoxVirtual Environment (VE)
Open vendor advisory

Android app · Google Play

Monitor future Proxmox CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Summary

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint.

Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

Affected versions
  • before 8.0.4
  • through 8.0

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Fixed versions
  • 8.0.4

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Mitigation

Upgrade to a fixed release: 8.0.4. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 3 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.