We required MFA. One query parameter turned it off.

📰 Dev.to · authagonal

Learn how a simple query parameter can bypass MFA and understand why MFA is a session property, not just a login step

intermediate Published 14 Jul 2026

Action Steps

Implement MFA as a session property, not just a login step
Validate MFA at every token endpoint
Test authentication systems for potential bypasses
Use secure protocols for token issuance and validation
Regularly review and update authentication systems for security vulnerabilities

Who Needs to Know This

Developers and security teams can benefit from this lesson to ensure the security of their authentication systems

Key Insight

💡 MFA is a property of the session, not just a step in the login process

Key Takeaways

Learn how a simple query parameter can bypass MFA and understand why MFA is a session property, not just a login step

Full Article

We challenged the second factor on the login page and never re-checked it at the token endpoint. So a valid password plus a hand-edited return URL walked straight past MFA. The fix, and the rule it taught us: MFA is a property of the session you issue, not a step in the login screen.

Read full article → ← Back to Reads