Achieving higher spectrum utilization, auction-based mechanisms has been regarded as a popular tool in dynamic spectrum access (DSA). Recently, Sybil attacks in auction-based DSA mechanisms have been investigated, where a cheating bidder can manipulate an auction by submitting bids under multiple fake identities. Existing Sybil-proof mechanisms in DSA are limited to prevent Sybil attacks from primary users (PUs) or secondary users (SUs). However, both of PUs and SUs may perform Sybil attacks in DSA, i.e., double Sybil attacks. The challenge of solving the double Sybil attacks is that fictitious identities and fake bids can directly affect allocation results, but the malicious bidders cannot be straightforwardly distinguished from all bidders. To resist the double Sybil attacks, we propose STEAM, the first double Sybil-proof and two-dimensional Truthful spEctrum Auction Mechanism for DSA. Specifically, STEAM merges suspicious buyers based on geographic characteristics and sorts sellers by a bid-independent sorting method to minimize the impact of untruthful bids and Sybil attacks on the allocation results. Theoretical analysis and extensive evaluations prove that STEAM is double Sybil-proof, two-dimensional truthful, individual rational and budget-balanced, while the performance loss in various metrics within 8% compared to the existing auction-based mechanisms.