This vulnerability (CVE-2026-73337) in Joomla! CMS arises from insufficient state checks in the MFA implementation, allowing an attacker to bypass two-factor authentication in affected versions 4.0.0 to 5.4.6 and 6.0.0 to 6.1.2. The flaw is categorized under CWE-287 (Improper Authentication). The CVSS 4.0 base score is 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on integrity. No known exploits in the wild or vendor patch information is provided in the input data.

Successful exploitation allows attackers to bypass two-factor authentication, potentially gaining unauthorized access to Joomla! CMS instances. This compromises the authentication integrity, increasing the risk of unauthorized administrative access and subsequent system compromise.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider additional compensating controls such as restricting access to the administrative interface by IP or using external authentication gateways.