MFA Second-Factor Login Session Binding

Context

If MFA verify does not bind the first-factor context, cross-client confusion and a redirect_uri bypass can be combined into account takeover.

Decision

MFA verify must check: the client registration relationship + the redirect_uri whitelist + a pending binding consistent with the first-factor login (users.mfa_pending_client_id / mfa_pending_redirect_uri, cleared to NULL after verification to prevent replay). All new rejections use the unified AUTH_INVALID_CREDENTIALS 401, eliminating the client-registration enumeration oracle. Known accepted limitations: mfa_token has no expiry and can be overwritten concurrently.

Consequences and Current State

The V022 migration is in the repository; MfaController is implemented according to the pending binding.