Summary;
The application allows a user to disable 2FA without asking for the current password, 2FA code, backup code, or any other verification.
If an attacker gets access to an active user session, they can disable 2FA without knowing the account password.
Steps to Reproduce;
Log in to an account with 2FA enabled.
Go to the account's security or 2FA settings.
Click Disable 2FA.
Notice that 2FA is disabled without asking for the current password or a 2FA/backup code.
The application should ask the user to re-authenticate before disabling 2FA, preferably by requiring the current password and a valid 2FA code.
2FA can be disabled without any additional verification.
Impact;
If an attacker gets access to an authenticated session, they can disable 2FA and remove an important layer of account protection. This could make a subsequent account takeover much easier.
Fix;
Require re-authentication before allowing 2FA to be disabled. The application should also consider invalidating active sessions after sensitive security settings are changed...