The E‑Mail MFA Provider extension does not reset the generated MFA code after a successful authentication, allowing the same code to be reused on subsequent login attempts. An attacker can supply an empty string as the MFA code, effectively bypassing the MFA check without needing the actual code. This flaw is a classic authorization bypass (CWE‑639) that can allow an attacker to obtain privileged access to user accounts and associated data.

The affected product is the TYPO3 E‑Mail MFA Provider extension. No specific affected versions are listed by the CNA, so all publicly available releases of the extension could potentially be compromised until an official fix is released.

The CVSS score of 7.7 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker who has already authenticated or has legitimate credentials for an account; after a successful login the attacker can reuse the empty code on subsequent attempts. Once the MFA check is bypassed, the attacker gains complete access to the compromised account and any resources reachable through that account. The overall risk is significant for sites that rely solely on this extension for MFA protection.