Special:Manage_Two-factor_authentication makes you reauthenticate before enabling 2FA. However, the logic for this doesn't apply to POST requests, to avoid forcing another reauth when the user submits the form later (T235645). This means it's easily bypassed by just making a POST request to https://en.wikipedia.org/w/index.php?title=Special:Manage_Two-factor_authentication&action=enable&module=totp instead of a GET request.

Exploit:

• Go to https://en.wikipedia.org/wiki/Special:Manage_Two-factor_authentication
• Click "Enable"; this shows a reauth screen, but you stole this session and don't know the password, so you don't want to reauth
• Click the back button to go back to https://en.wikipedia.org/wiki/Special:Manage_Two-factor_authentication
• Open the browser console and run:

$('.oo-ui-panelLayout a[role="button"]').each( function () { $(this).replaceWith( $('<form>').attr( { action: $(this).prop('href'), method: 'post' } ).append( $('<input>').attr( { type: 'submit', value: $(this).text() } ) ) ); } );

• • (this replaces the Enable button, which was a link to https://en.wikipedia.org/w/index.php?title=Special:Manage_Two-factor_authentication&action=enable&module=totp , with a form that submits a POST request to that same URL)
• Click the replaced Enable button
• You now get the 2FA setup screen, without having to reauth