---
id: 5222
title: "[CVE-2024-52597] Stored Cross-Site Scripting (XSS) in 2FAuth"
cve: CVE-2024-52597
source_domain: xbow.com
source_url: "https://xbow.com/blog/xbow-2fauth-xss"
published_at: "2024-12-13T13:00:00Z"
tags: ["vulnerability-research", "open-source", "xss", "svg-upload", "2fauth", "cve-2024-52597"]
phying_url: "https://phying.com/item/5222"
lang: en
---

# [CVE-2024-52597] Stored Cross-Site Scripting (XSS) in 2FAuth

## Summary

Documents how XBOW reached stored XSS in 2FAuth (CVE-2024-52597) through SVG uploads in the QR-code decoder, after working around authentication, and validated it in a headless browser.

## Intelligence Metadata

- **Sources:** xbow.com
- **CVE:** CVE-2024-52597
- **Published:** 2024-12-13T13:00:00Z
- **Original:** https://xbow.com/blog/xbow-2fauth-xss
- **Phying News:** https://phying.com/item/5222