This vulnerability in Joomla! CMS arises from insufficient state validation that enables bypassing of 2FA protections. Affected versions include 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 base score is 8.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts the authentication process, potentially allowing unauthorized access by circumventing 2FA controls. No patch or official remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to bypass two-factor authentication, potentially gaining unauthorized access to Joomla! CMS instances running the affected versions. This undermines the security assurances provided by 2FA, increasing the risk of account compromise. However, there are currently no known exploits in the wild.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is released, consider implementing additional compensating controls such as monitoring authentication logs for suspicious activity and restricting access to trusted networks where feasible. Avoid relying solely on 2FA for critical authentication until the vulnerability is addressed.