TeamViewer Full Client and Host for macOS versions prior to 15.80 contain a business logic flaw that lets an attacker who has already authenticated exploit the Unattended Access feature to bypass a configured Two‑Factor Authentication (2FA) step in the Connections approval flow. By doing so the attacker can establish a remote session with the host, gaining full control and compromising confidentiality, integrity, and availability of the machine. The weakness falls under CWE‑288, representing an unauthorized use of authentication.

The vulnerability affects TeamViewer Full Client and Host on macOS released before version 15.80. This includes the TeamViewer ONE, TeamViewer Remote, and TeamViewer Tensor product lines offered by the vendor TeamViewer. Only macOS hosts using these pre‑15.80 builds are impacted.

The CVSS score of 8 indicates high severity. However, the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation at present. The attack requires an authenticated user with access to Unattended Access settings; consequently, the risk is greatest to accounts with privileged permissions or users that have granted themselves unattended rights. Once authenticated, the attacker can immediately bypass 2FA and create a remote session, making mitigation through a patch critical.