CVE-2024-27928 is a vulnerability in vantage6 versions prior to 5.0.0 where two-factor authentication (2FA) can be bypassed if an attacker gains access to the user's email account. The attacker can reset both the password and the 2FA token via email, effectively reducing 2FA to single-factor authentication. This issue is mitigated by the fact that most email providers require 2FA themselves, making exploitation less likely. The vulnerability is fixed in vantage6 version 5.0.0.