A compromise of a user’s email account allows an attacker to reset the user’s password through the standard email verification process and then reset the two‑factor authentication token via the same mechanism. The attacker effectively reduces the user’s authentication method from two‑factor to single‑factor, enabling full access to the victim’s account. The weakness is a flaw in the handling of email‑based password and 2FA reset procedures (CWE‑308).

The vulnerability exists in Vantage6, the open‑source privacy‑preserving analysis platform, in all releases prior to version 5.0.0. Users of earlier versions are susceptible to this attack. The vendor has released an update in version 5.0.0 that removes the flaw.

The CVSS base score of 5.9 indicates moderate severity while the EPSS score of less than 1 % reflects a very low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to already possess access to the victim’s email account, a scenario that is plausible but mitigated by most email providers’ own 2FA requirements. Nonetheless, once email access is achieved, the attacker can immediately hijack the Vantage6 account by resetting the password and 2FA token.