Multi-factor authentication (email) can be bypassed in multi-panel apps with colliding user IDs

Email-based multi-factor authentication stored the hashed code and expiry in the browser session under keys derived only from the user's primary key. Its send rate limit was also keyed only by that primary key. In a multi-panel application where panels share the browser session but use different authentication guards and user-model classes, unrelated users with the same primary key therefore shared this state. This issue does not affect ordinary single-panel configurations or app-based MFA.

If an attacker controls one colliding account, knows the victim's password, and starts both login challenges in the same browser session, they can request codes for their own account until the shared send limiter is exhausted. The last attacker code remains stored. Starting the victim's challenge then issues no replacement code, allowing the attacker's code to complete the victim's challenge and authenticate without access to the victim's mailbox.