Ikaros EUVD-2026-98930

Exploitation requires that the attacker already possesses valid first-factor credentials (a correct password) for a target account AND that the account relies on TOTP second-factor verification, which this flaw defeats. The specific technical prerequisite is access to the temporary login token issued by the jwt/apply endpoint, which the attacker then reuses as a bearer JWT, via token refresh, or through HTTP Basic login to skip TOTP. The limiting factors are: valid password knowledge is mandatory (so this is not a pre-authentication bypass), and the impact is bounded by the privilege of the compromised account - though the description confirms it extends to the master administrator. Applies to default deployments of Ikaros versions 1.2.0 through 1.2.5.

This is a genuine but conditional priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, 8.6 High) indicates network-reachable, low-complexity exploitation requiring only low privileges - consistent with the description, which states the attacker must already hold a valid password (first factor) and then bypasses TOTP second-factor verification. The core signal is CWE-287 improper authentication: the login temp token issued by the jwt/apply endpoint can be reused as a bearer JWT, refreshed, or replayed via HTTP Basic login to reach full account access including the master administrator, defeating the entire purpose of 2FA. No EPSS score, CISA KEV listing, or explicit POC flag was provided in the input, so exploitation probability cannot be quantified from the data; however, a detailed public technical writeup (hackmd) and a VulnCheck advisory exist, which materially lowers the barrier to developing a working exploit even though neither constitutes confirmed exploit code or active exploitation. The practical risk is bounded by the precondition that the attacker must already possess valid first-factor credentials, so this is best characterized as a 2FA-defeating privilege/assurance bypass rather than a fully unauthenticated takeover. No conflicting signals in the data: CVSS and description agree on network vector and partial-privilege prerequisite.

An attacker who has obtained a user's password (via phishing, reuse, or leak) but is normally blocked by TOTP captures the temporary token returned by the jwt/apply login endpoint and replays it - as a bearer JWT, via a token refresh, or through HTTP Basic login - to complete authentication without the second factor. If the targeted account is the master administrator, the attacker gains full administrative control. No public exploit code is identified in the data, but a detailed technical writeup describing the token-reuse flaw is publicly available.