WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider

Description

The plugin does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts.