> For the complete documentation index, see [llms.txt](https://wiki.smhuda.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.smhuda.com/vulnerability-wiki/application-level/authentication/2fa-code-brute-forceable.md).

# 2FA Code Brute-forceable

### Severity: 

<mark style="color:green;">**Low**</mark>

### How to test:

1. Submit invalid account credentials and a valid captcha on the login form.
2. Capture the request with a proxy. It can be submitted multiple times and with different authentication data.