umbraco-security-2fa

This code implements TOTP two-factor enrollment and validation, but sends the account name and MFA enrollment secret to `api[.]qrserver[.]com` in a QR-image URL. This is a significant credential-disclosure risk, although the fragment alone does not establish malicious intent or other malware behavior. Severity is high for confidentiality of the MFA seed; use local QR generation or another method that does not transmit the secret to a third party.