AIKIDO-2025-10561

TL;DR

Affected versions of this package are vulnerable to a Highly Critical Authentication Bypass vulnerability, where insufficient validation in AJAX callback handlers allows attackers to log in as any known user account without valid credentials. By sending a carefully crafted series of requests (as few as five by default) to trigger specific unvalidated authentication conditions, an attacker can completely bypass two-factor authentication protections. While the required request sequence might alert vigilant site monitors, the low threshold of requests, combined with predictable usernames, enables practical exploitation with a minimal forensic footprint.