2FA requirement bypass when inviting team members

How it was found

Summary:

The application requires users to enable 2FA before sending team invitations. However, this restriction can be bypassed by modifying client-side responses (match and replace from false to true). This allows invitations to be sent without enabling 2FA, defeating the security requirement.

Steps To Reproduce:

1. Sign up / log in to the application.

2. Go to the Team section.

3. Try to invite a new member → the application blocks the request, requiring 2FA. {F4819623}

4. Use a Burp extension ( Match and Replace) to change the client-side flag false → true. {F4819627}

5. Refresh the page then attempt to send an invitation again.

6. The invitation is sent successfully without enabling 2FA. {F4819634}

Impact

1. This bypass allows attackers to ignore the enforced security policy.

2. Reduces the effectiveness of 2FA enforcement.

3. Could allow compromised accounts to invite unauthorized users without 2FA protection.

Recommendation

Ensure 2FA requirement is validated on the server-side before processing any team invitation requests, instead of relying only on client-side checks.