The updated description corroborates that the user‑augmentation resolver unconditionally exposes the raw two‑factor recovery codes. This flaw, categorized as CWE‑200 (Information Exposure), reveals the raw recovery codes whenever the variable is rendered in an Antlers template. An attacker who can view or capture the generated HTML can obtain these codes and bypass two‑factor authentication for the victim.

The vulnerability exists in the Statamic Content Management System. No specific version range is listed; any release that still contains the AugmentedUser::get implementation is potentially impacted until the fix is applied. Users should verify whether their installation includes the recent security patch that removes the exposed two_factor_recovery_codes handle.

The CVSS score of 6.2 denotes medium severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score of 0.00229 indicates a very low but non‑zero probability of exploitation. Exploitation requires that a template has dynamic Antlers rendering enabled for a field that flows through the current_user object, a privilege normally limited to administrators or blueprint designers. If an attacker can embed the {{current_user.two_factor_recovery_codes}} tag in a page that a target user will view, the two‑factor recovery codes will be exposed in the HTML response, enabling a simple 2FA bypass.