As you may have already seen, (J)Wt 4.15.0 fixed a vulnerability in wt-auth that allowed an attacker to bypass the second step of multi-factor authentication (MFA).
For this exploit to work, an attacker needed to attempt to register with the victim’s username. They would then be able to click a link that prompted them for the password of the user they were trying to register as. Once the correct password was entered, the attacker was logged in without needing to use the secondary authentication method (TOTP by default).
While upgrading (J)Wt to version 4.15.0 solves this issue, we understand that you may want to stay on a stable release such as 4.14.4.
If this applies to you, we recommend disabling registration via the AuthWidget. This is typically disabled by default, but may have been enabled using the AuthWidget::setRegistrationEnabled() method.
If this is not an acceptable solution, you can override AuthWidget::createRegistrationModel() so that it returns a custom RegistrationModel that either prevents the link from appearing or requires the secondary authentication method before logging the user in.