Short-lived MFA challenges bind to a pending session, step-up gates sensitive actions, recovery codes are single-use, and a password replay cannot skip an in-progress or required second factor.
Published Sep 12, 2026
This Block has no declared dependencies.