The vulnerability arises from insufficient state checks in Joomla’s core authentication flow, allowing an attacker to bypass multi‑factor authentication (MFA) for compromised accounts. This flaw lets valid credentials reach the site without completing the second factor, effectively granting the attacker full administrative control and compromising confidentiality, integrity, and availability of the system. The weakness is identified as CWE‑287, indicating an authentication bypass error.

All Joomla! CMS installations in the version ranges 4.0.0‑5.4.7 and 6.0.0‑6.1.2 are affected. Administrators should verify their exact Joomla version and refer to the official Joomla security advisory for patch details.

The CVSS score of 8.2 classifies the vulnerability as high severity. Although the EPSS score is not available, the fact that the issue is not listed in the CISA KEV catalog suggests limited public exploitation to date. The likely attack vector is remote via the site’s web interface, requiring only web access to the affected installation. Once the bypass is executed, an attacker can assume any administrative role on the site, posing a significant threat to all hosted services.