The vulnerability arises from insufficient state checks, enabling an attacker to bypass 2‑factor authentication during the login process. An attacker who can submit a valid username and password can skip the second verification step, thereby gaining the same level of access as the legitimate user. This compromise affects the confidentiality, integrity, and availability of the affected system by permitting unauthorized use of privileged accounts and potential further exploitation.

Vendors and product affected: Joomla! Project – Joomla! CMS. No specific affected version information is provided in the data, so any installation that could lack the fix from the referenced advisory may be vulnerable.

The CVSS score of 8.2 indicates high severity. EPSS is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via the web interface, where an attacker can exploit the login page to omit the second authentication factor. The lack of a listed KEV entry suggests no confirmed exploits yet, but the high severity calls for prompt remediation.