The Joomla! CMS core has a flaw where a remember‑me cookie is issued prematurely. This allows an attacker to authenticate without completing the second authentication factor, effectively bypassing configured MFA. The weakness falls under CWE‑287 and can compromise confidentiality and integrity of user accounts.

Joomla! CMS versions 4.0.0 through 5.4.8 and versions 6.0.0 through 6.1.3 from the Joomla! Project are affected. The vulnerability exists in the core application that manages remember‑me functionality.

The CVSS score of 8.2 indicates high severity. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. The attack likely requires manipulation of the remember‑me cookie via a web request; an attacker may construct a forged cookie and send it to the victim's browser or leverage a compromised account to trigger the bypass. Because the flaw allows sign‑in without MFA, successful exploitation would grant full account access.