How I Bypassed 2FA by Mutating My Profile Phone Number in Graphql Request

How a simple phone number update in Graphql request compeletly bypassed 2fa protection and gave full account control.