Marc-André Bombeck e1718e3c30 fix(auth): count a second-factor attempt before verifying it ...

The login challenge read its attempt count, verified the factor, and only
then incremented. Requests sent in parallel all read the same count below
the cap, so one ticket allowed more guesses than the cap. Each attempt is
now reserved by a single guarded UPDATE before the factor is evaluated,
and a failure only settles the reserved attempt.

2026-09-26 15:21:42 +02:00

..

fixtures/v137

Let a checkup be skipped or pushed back, and remember every outcome

2026-08-14 09:23:58 +02:00

integration

fix(auth): count a second-factor attempt before verifying it

2026-09-26 15:21:42 +02:00