ROGUE MFA PROVIDERS CAN STEAL PASSWORDS

Security researchers have demonstrated an attack allowing hackers with privileged access to register fake MFA providers and harvest user passwords during login. The vulnerability exploits the authentication process itself.