2FA Step-Skipping & Flawed Verify Logic

Two-factor flows are multi-step: verify password → verify code → grant access. Step-skipping attacks exploit endpoints that assume the steps always happen in order.

How it works

• Forced browsing: after the password step issues a half-authenticated session, the attacker navigates directly to /account or /dashboard. If those pages only check "is logged in" rather than "is MFA complete", access is granted.
• Pre-2FA token reuse: the token representing "password OK, awaiting code" is accepted by post-auth APIs.
• Verify reuse: a single OTP verification is replayable, or the code isn't bound to this session/attempt.

How to test

Complete only the password step, then request protected resources directly. Replay the pre-2FA token against APIs. Check whether the OTP is single-use and session-bound.

Impact

MFA becomes optional in practice — password-only access.

Defenses

• Gate every protected route on a session state of "MFA fully satisfied", not merely "authenticated".
• Bind OTPs to the session and attempt; make them single-use and short-lived.