The vulnerability exists in FacturaScripts' Core/Controller/Login.php method twoFactorValidationAction(), which processes 2FA validation without requiring password verification or CSRF tokens, and without rate limiting. The verification window for TOTP codes is set to 8, allowing approximately 17 valid codes at once, increasing the chance of guessing a valid code. An attacker who knows a target's username (nick) can brute force the 2FA code via unauthenticated POST requests to /login?action=two-factor-validation. This leads to full session cookie issuance and complete account takeover. The vulnerability is present in all versions before 2026.3. A public proof-of-concept exploit exists demonstrating the attack.

An unauthenticated remote attacker can completely bypass two-factor authentication and gain full access to any 2FA-enabled user account by brute forcing valid TOTP codes. This includes administrative accounts, which typically have publicly guessable usernames. The attacker gains full read and write privileges as the compromised user, potentially exposing sensitive data and allowing unauthorized actions. The vulnerability also enables targeted denial-of-service by locking out legitimate users after repeated failed attempts. The overall impact is critical, compromising confidentiality and integrity with minimal availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling 2FA or restricting access to the vulnerable endpoint if possible. Monitoring for unusual authentication attempts and applying external rate limiting may help mitigate brute force attacks. Avoid exposing the 2FA validation endpoint publicly. Follow vendor updates closely for an official patch or temporary mitigations.