ABP Framework versions before 10.7.1 have an authentication bypass vulnerability. This flaw allows attackers who possess the external directory password for accounts that are deactivated, locked, or protected by two-factor authentication to bypass account state and 2FA checks. By exploiting the registered IExternalLoginProvider, attackers can successfully obtain valid access tokens via the /connect/token password grant endpoint. The vulnerability is fixed in version 10.7.1.