Two-factor authentication bypass