Vulnerabilities in multi-factor authentication
Summary: PortSwigger Research outlines how poorly implemented two-factor authentication can be beaten or bypassed entirely, including cases where a site puts the user in a logged-in state after the password step before the verification code is entered. It also describes a logic flaw where the second step trusts an account cookie set after the first step, letting an attacker swap in an arbitrary username and brute-force the 4 or 6-digit code without knowing the victim's password.
What you should know: A 4 or 6-digit verification code is trivial to crack without brute-force protection, and auto-logout after a set number of wrong codes does not stop an attacker who automates the multi-step process with tools like Burp Intruder or Turbo Intruder.
Read the original at PortSwigger Research ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026