This vulnerability (CWE-287) in Joomla! CMS arises from the premature issuance of a rememberme cookie, which enables an attacker to bypass multi-factor authentication mechanisms. The issue affects Joomla! versions 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3. The CVSS 4.0 base score is 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity. No known exploits are reported in the wild. No vendor advisory or patch information is provided in the input data.

Successful exploitation allows an attacker to bypass MFA protections, potentially gaining unauthorized access to user accounts without completing the intended second authentication factor. This compromises the integrity of the authentication process and can lead to unauthorized access to sensitive Joomla! CMS resources.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the rememberme cookie feature or enforcing additional authentication controls as a temporary mitigation.