AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA (CVE-2026-45610) | HOL Guard CVE