An authentication bypass vulnerability in Proxmox Virtual Environment (VE), identified as CVE-2023-54391, was reportedly exploited on the same day it was publicly disclosed. The flaw affects Proxmox VE versions 7.0 through 8.0 and resides in the `libpve-access-control` component, specifically in versions prior to 8.0.4.
The vulnerability allows unauthenticated attackers to bypass the authentication process and log in as any existing enabled user, even if two-factor authentication (2FA) is configured. This is achieved by sending a POST request to the API login endpoint and providing an arbitrary value for the `tfa-challenge` parameter. This action effectively skips password verification, granting unauthorized access, including to the `root@pam` account.
The CVE-2023-54391 record was published on September 1, 2026, with a critical CVSS score of 9.8. On the same day, September 1, 2026, the vulnerability was listed in the VulnCheck KEV (Known Exploited Vulnerabilities) catalog, indicating active exploitation. The CIRCL aggregator also mirrored this listing. Public exploitation evidence was reported starting September 1, 2026, with several sources documenting the issue, including forum discussions and security advisories.
Proxmox has confirmed the vulnerability. All affected Proxmox VE releases (7.0 through 8.0) are currently end-of-life. The patch for this vulnerability is included in `libpve-access-control` version 8.0.4 and later.
