GHSA-xwpv-pqxp-5v36

When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating `canAccessPanel()`. For an account that `canAccessPanel()` denies, submitting the correct password renders the challenge while an incorrect password returns the generic failure message, allowing an unauthenticated attacker to confirm that a password is valid for that account. When email-based multi-factor authentication is used, a login code is also sent to the account holder.

This issue **only** applies to accounts that both have multi-factor authentication enabled and are denied by `canAccessPanel()`. Authentication is not bypassed as the check still runs after the challenge, and no session is created.