Answer in brief
CVE-2023-54391 records a Critical severity (CVSS 9.3) vulnerability in Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter. The current sources do not mark it as known exploited. The current feed maps Proxmox Server Solutions GmbH/Proxmox Virtual Environment (VE) (generic), Proxmox Server Solutions GmbH/Proxmox Virtual Environment (VE) (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Proxmox Server Solutions GmbH/Proxmox Virtual Environment (VE) (generic), Proxmox Server Solutions GmbH/Proxmox Virtual Environment (VE) (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Proxmox Server Solutions GmbH/Proxmox Virtual Environment (VE)generic | >=7.0 <=7.4 || 8.0 | Not reported |
| Proxmox Server Solutions GmbH/Proxmox Virtual Environment (VE)generic | 7.0 || 8.0 | Not reported |
Published upstream
Sep 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 1, 2026
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.
Quoted source text, attributed separately from HOL analysis.