CVE-2026-108071: Improper Multi-Factor Authentication Validation Allows Authentication Bypass
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need before they can exploit this issue?
The attacker must already have valid first-factor credentials. The issue allows them to complete login without a valid second-factor token because the MFA validation result is not correctly applied.
What access could a successful attacker obtain?
A successful attacker can bypass the second MFA factor and gain access to protected applications and resources available through TSplus Remote Access.