Marc-André Bombeck 8cb958bf27 fix(auth): accept a TOTP code only from a confirmed secret ...

A pending secret from an enrollment that was never confirmed counted as a
second factor wherever a code was verified: step-up minting, the passkey
enrollment re-proof, MFA disable and login completion. Anyone holding a
session can create a pending secret, so a code from one proves nothing
about the account owner. verifyMfaFactor now refuses both TOTP and
recovery codes until totpConfirmedAt is set.

2026-09-26 15:19:26 +02:00

..

fixtures/v137

Let a checkup be skipped or pushed back, and remember every outcome

2026-08-14 09:23:58 +02:00

integration

fix(auth): accept a TOTP code only from a confirmed secret

2026-09-26 15:19:26 +02:00