Ikaros versions 1.2.0 through 1.2.5 suffer a flaw that permits an attacker to bypass two‑factor authentication. By reusing a temporary login token that is issued by the jwt/apply endpoint, a user who already knows a valid password can authenticate as any account without providing the second factor. This flaw is an instance of improper authentication (CWE‑287) and allows full account takeover, including privileges of the master administrator.

The vulnerability affects the Ikaros product developed by Ikaros‑dev. Any installation running any patch level from 1.2.0 up to and including 1.2.5 is vulnerable.

The CVSS score of 8.6 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack scenario involves an attacker who has a valid user credential and has obtained a temporary token from the jwt/apply endpoint. This token can then be reused as a bearer JWT, refreshed, or used with HTTP Basic login, enabling the attacker to impersonate any user, including the master administrator. The exploitation path requires network access to the vulnerable endpoints, so the likelihood is non‑negligible in exposed environments.