I am trying to understand the logic behind following vulnerability, I believe this a design flaw not only an implementation.
To me the problem with the two-factor authentication service at PayPal is that the server does not distinguish between authentication request coming from the mobile app and the web-app. For that reason when the server disable the two-factor authentication based on the mobile app request it got disabled for the user account, and not only the user mobile app. Is my interpretation correct?
Post: PayPal Vulnerability
Vulnerability Description: It has recently reported that Paypal two factor authentication security measures can be bypassed. The vulnerability or flaw pertains to the way that PayPals authentication flow works with the services mobile apps for iOS and Android. PayPal gives users the ability to utilize two-factor authentication in a variety of ways, each which creates a one-time passcode for login. Two-factor forms are available to be used on the official PayPal website, but is not supported by PayPal mobile apps. Here is how it worked: When PayPal servers responded to a POST request sent from the mobile app for a two-factor enabled account. The application would show an error message telling the user two-factor was enabled and not supported, initially sending the user back to the login . But when the value in the server’s response in regards to the two-factor authentication is changed to “false”, the application would simply allow the user into the account, bypassing all forms of two-factor protection.