CVE-2023-54391: Proxmox Server Solutions GmbH Proxmox Virtual Environment Ve

Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days.

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

Affected products

Published 2026-09-01. Last modified 2026-09-08.