Explore how a CORS misconfiguration led to a full account takeover and bypass of two-factor authentication, with insights into the methodology and impact.