A flaw in Umami’s 2FA policy handler allows an attacker to bypass the second factor and authenticate using only a single credential. The vulnerability occurs when a crafted request to the login route is processed, causing the system to accept a single‑factor login even though two‑factor authentication should be enforced. This creates a direct path for remote attackers to gain legitimate access without providing the second authentication factor, compromising confidentiality and potentially the integrity of user accounts. The weakness is a classic authentication bypass (CWE‑287).

Umami versions 3.3.x, 3.4.0, and 3.4.1 are affected. The issue resides in the file src/app/api/auth/login/route.ts within the 2FA policy handler component. No other versions are known to be vulnerable at this time.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been reported as a known exploit. The attack can be initiated remotely via the public‑facing login endpoint. No additional exploitation conditions are detailed, so a remote attacker who can send a crafted request to the affected login route can likely obtain unauthorized access.