A vulnerability in Kalcaddle Kodbox 1.64 allows an attacker to manipulate the loginAfter/tfaVerify function in the tfa/index.class.php file to bypass two‑factor verification and authenticate as any user, thereby gaining unauthorized access to protected resources. The flaw corresponds to improper authentication (CWE‑287) and enables misuse of accounts, potential data exfiltration, and possible privilege escalation.

The issue affects Kalcaddle Kodbox version 1.64, specifically the file located at /workspace/source-code/plugins/client/controller/tfa/index.class.php within the Password Login component. No other versions are reported as vulnerable; therefore only installations of 1.64 are at risk until a vendor fix becomes available.

The CVSS base score of 6.3 indicates moderate severity, and the description notes high complexity and difficult exploit, but confirms that the exploit has been publicly disclosed and may be used. The attack vector is remote, meaning an attacker does not need local access to trigger the vulnerability. Although exploitation is reported as difficult, the public availability of exploit code raises the likelihood that attackers may attempt to use the flaw, especially if the vendor does not release a patch promptly. The vulnerability is not listed in CISA’s KEV catalog and no EPSS score is available, so its current exploitation probability remains uncertain; nevertheless, the potential for unauthorized access warrants immediate mitigation.