CVE-2026-47677

"Core/Controller/Login.php::twoFactorValidationAction" accepts an unauthenticated POST containing only "fsNick" and "fsTwoFactorCode". If the TOTP value matches, the server issues a full "fsNick" + "fsLogkey" session cookie pair. The handler: 1. Does not verify the password — the user is not...