Two-factor authentication (TOTP) can be fully bypassed for the REST API. The "KIMAI_SESSION" cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every "/api/*" endpoint. So after submitting just the password, the web UI correctly holds the browser at the TOTP screen ("/en/auth/2fa"), but the cookie from that same login response can be replayed against the API to act as the user without ever entering the second factor. This affects any account with 2FA enabled and requires only the account password.