auditing-mfa-enrollment-and-reset-abuselisted

# Auditing MFA enrollment and reset abuse: the second factor is only as strong as how you enroll and reset it Multi-factor authentication assumes the attacker who has the password still cannot pass the second factor, and that assumption lives or dies in three places most audits skip: how a factor is enrolled, how it is reset or recovered, and how a step-up is enforced. If an account with only the first factor satisfied can enroll a new authenticator without re-proving identity, an attacker with a stolen password simply adds their own second factor and now passes MFA legitimately. If the reset or recovery flow is guarded only by a weak signal, an email link to an inbox the attacker controls, a knowledge question, a support request that does not verify hard, then MFA resets back to attacker control and the second factor is decorative. If a step-up prompt on a sensitive action can be skipped, or backup codes are weak, reusable, or handed out without authentication, or a push approval lands on a single tap so fatigue or bombing gets an accidental yes, the factor is bypassed rather than broken. The audit treats enrollment and reset as privileged actions that must re-prove identity, and checks that every step-up is actually enforced. You audit this by holding only the first factor and trying to add, reset, or skip the second. ## When to use - An authentication system lets users enroll a second factor, reset or recover it, use backup codes, or satisfy a step-up prompt. - Enroll