@dangoodin@infosec.exchange Without addressing the specifics of this case (about which I know no more than the public info), some 2fa authentication code implementations can be vulnerable if they are not properly rate limited or otherwise protected against high speed stuffing. Usually of course 2fa follows a successful id/password authentication, though not always.