An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the activated second factor to the /session endpoint
https://piuswalter.de/blog/2fa-bypass-and-deactivation-attack-in-mytaag/