MFA TOTP can be reused, after successful verification.

[gpeires]

Using the supabase-js sdk, I am able to reuse the same TOTP after using it to verify a MFA challenge, while it is not yet passed the time expiration.

I also tested the Supabase dashboard login, and it exhibits the same behavior.

This would appear to be a vulnerability. Does anyone have any clarity on this?