03-01-2026, 12:30 PM
Medium
resolved
resolved
2FA requirement bypass when inviting team members
Bug reported by Youssef AboHashish was disclosed at February 28, 2026, 8:55 pm | Improper Access Control - Generic
The application's requirement for users to enable 2FA before sending team invitations was bypassed by modifying client-side responses. This allowed invitations to be sent without enabling 2FA, defeating the security requirement.