Two factor seed page was not properly checking for user session, allowing an authenticated user to see everyone's 2fa seed
Pietro Tarenzi