2FA / MFA bypass

When it applies

Authentication has a second step after the password. MFA is only as strong as its enforcement — the common flaws are in the flow, not the crypto, and each is worth a quick check before assuming the factor is solid.

Why it works

The second factor is usually bolted onto a stateful flow, and the server often trusts the client to follow it. Skip the step, replay a state, or brute a short code with no rate limit, and the factor never actually gates access.