CVE-2026-108071: CWE-304 Missing critical step in authentication in TSplus TSplus Remote Access

This vulnerability (CWE-304) in TSplus Remote Access 19.20.3.10 involves an incorrect authentication flow in the MFA implementation. The system fails to correctly apply the MFA validation result, allowing a remote attacker who has valid first-factor credentials to skip the second-factor authentication step. This enables the attacker to complete the login process without presenting a valid second-factor token, thereby compromising the security of the protected environment.

An attacker who successfully exploits this vulnerability can bypass the second-factor authentication requirement and gain unauthorized access to applications and resources protected by TSplus Remote Access. This undermines the security benefits of MFA, potentially leading to unauthorized data access or system control.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider additional compensating controls such as restricting access by IP, monitoring for suspicious login activity, or temporarily disabling MFA if feasible and safe.