Can you clarify what it means by “bypassing the attachment control”? The control itself does have properties to specify what file types are allowed, I’m assuming there was a way to get around whatever file types were configured there?

Hi, the user is able to bypass the custom two-factor authentication mechanism by intercepting the request and manipulating the data to redirect to the main page.