# CVE-2023-54391: Proxmox Virtual Environment (VE) - Authentication Bypass

> Live exploitation tracking for CVE-2023-54391 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-54391

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Proxmox Server Solutions GmbH Proxmox Virtual Environment (VE)
- **Weaknesses:** CWE-304 (Missing Critical Step in Authentication)
- **Tags:** enterprise_software, management_panel

## Description

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

## CrowdSec analysis

[CVE-2023-54391](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-54391) is a critical authentication bypass vulnerability in Proxmox Virtual Environment (VE) versions 7.0 through 8.0, affecting libpve-access-control before 8.0.4. Unauthenticated remote attackers can bypass password verification by submitting an arbitrary two-factor authentication challenge, potentially authenticating as enabled users—including root@pam—and gaining complete control of the virtualization environment.

CrowdSec has been tracking this vulnerability and its exploits since 4th of September 2026.

CrowdSec network data shows that most actors exploiting CVE-2023-54391 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec network telemetry also shows that exploitation of CVE-2023-54391 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers target the Proxmox VE authentication endpoint `/api2/json/access/ticket` with the default `root@pam` username and password, alongside a crafted `tfa-challenge` parameter to bypass two-factor authentication and obtain a privileged session ticket.

## Timeline

- 2026-09-01: CVE Published. CVE-2023-54391 is published to NVD.
- 2026-09-04: Rule Released. CrowdSec releases a rule to detect CVE-2023-54391 exploitation attempts against the CrowdSec Network.
- 2026-09-04: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-54391 for the first time.

## References

- https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=0f3d14d6be4d9f23e511701696a529ef3b7ffd61
- https://www.vulncheck.com/advisories/proxmox-ve-authentication-bypass-via-tfa-challenge-parameter
- https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-4#post-867929
- https://git.proxmox.com/?p=pve-access-control.git;a=commit;h=032e7d6d441f89a48cadfd7f47e957c8a561c022
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-54391.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-54391) follows observed exploitation activity for CVE-2023-54391. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.