We recommend all Really Simple Security (Free and Pro) users to update their plugin to version 9.1.2
Security researcher István Márton made us aware of a Authentication Bypass vulnerability with version 9.0.0 up to 9.1.1.1.
Attackers could bypass authentication for certain 2FA configurations.
In collaboration with the WordPress plugins team we prepared a security patch that in most cases will be force-updated.
This means that it is likely that your site has already received the patch.
Though we recommend to verify that your site has in fact installed version 9.1.2 (or later).
Vulnerability detection
The situation shows that bugs and security flaws occur with every software package, CMS or plugin.
Even to those with extensive security protocols and specialists that work on WordPress security every day of the week.
This underlines the need for vulnerability detection as part of Really Simple Security and its peers.
With Vulnerability Detection you will be notified and/or force-updated in case of a vulnerability.