This vulnerability arises from improper handling of the MFA validation result in TSplus Remote Access. A remote attacker who successfully supplies valid first‑factor credentials can circumvent the second‑factor challenge, gaining full authentication without presenting a legitimate second‑factor token. The result is unauthorized access to protected applications and resources, undermining the integrity of the authentication mechanism.

TSplus Remote Access version 19.20.3.10 is affected, along with any later releases that have not yet incorporated the patch. Administrators should verify the installed version against the CPE record and upgrade accordingly.

The CVSS score of 8.7 classifies this as a high‑severity flaw. The EPSS score of 0.00469 (≈0.47%) indicates a low but nonzero probability of exploitation, underscoring that an attacker who can acquire valid first‑factor credentials still has a modest chance of success. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring network access to the TSplus server and possession of basic login credentials. Once the MFA validation logic is bypassed, the attacker can access all resources available to the authenticated account.