CVE-2023-54391: Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
Proxmox Server Solutions GmbH · Proxmox Virtual Environment (VE)
Fixed in 8.0.4 · Affected: Proxmox Server Solutions GmbH Proxmox Virtual Environment (VE) before 8.0.4 · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 87% of scored CVEs
DescriptionCVE.org
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Proxmox Server Solutions GmbH · Proxmox Virtual Environment (VE)from 7.0 up to and including 7.4; 8.0
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Proxmox VE - Default Credentials with TFA Bypass · nuclei template in projectdiscovery/nuclei-templates
- Published
- September 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2023-54391 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.