MFA bypass: where the second factor breaks

Multi-factor auth is only as strong as its implementation. The attacks do not break TOTP: they bypass how it is wired to login.

The weak points

No rate limit on the 6-digit code: a million combinations are brute-forced quickly.

Skippable flow: if the "MFA passed" state is not checked on every endpoint, the protected area is reachable by skipping the step.

MFA fatigue: spamming push prompts until the victim approves out of exhaustion.

Weak reset/backup codes, or reusable OTP.

Defence

Rate limit and lockout on OTP attempts, single-use short-lived codes, server-side MFA-state check on every sensitive action. For push, number matching. Prefer WebAuthn/passkeys, which resist phishing.