EC‑Cube includes a vulnerability that allows a multi‑factor authentication bypass. An attacker who has already obtained a valid administrator ID and password can circumvent the second authentication factor and gain unrestricted access to the administrative interface. This flaw essentially turns a multi‑factor protected account into a single‑factor one, enabling full administrative control for an attacker without any additional privileged credentials.

The vulnerability is present in EC‑Cube 4.1 series (specifically 4.1.2 and its patch releases p1‑p4), EC‑Cube 4.2 series (4.2.3 and its p1 patch), and EC‑Cube 4.3 series (4.3.1). These versions are distributed by EC‑Cube Co.,Ltd. Users running any of these releases are at risk.

The CVSS score of 6.9 categorises the problem as moderate severity. The EPSS score of less than 1 percent indicates a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to first acquire administrator credentials, which could be achieved through credential theft, social engineering, or other means. Once credentials are in hand, the attacker can exploit the MFA bypass remotely, capitalising on the flawed authentication logic described by the vendor advisory.