MFA bypass attacks expose the gaps around authentication

At a glance

What this is: This is an RSA Security analysis of common MFA bypass patterns, showing that attackers usually target surrounding identity controls instead of the factor itself.

Why it matters: It matters because IAM teams cannot treat authentication as the whole defence; recovery, delegation, third-party access and entitlement governance all shape whether MFA actually reduces breach risk.

Context

MFA bypass is fundamentally an identity governance problem, not just an authentication problem. The practical gap is that security programmes often harden the login event while leaving enrollment, recovery, fallback, delegation and entitlement paths under-governed.

In these attacks, the factor is not defeated by cryptography alone. Attackers look for weak policy, poor monitoring, fail-open behaviour and third-party access that can be abused even when MFA is present.

That makes MFA a necessary control, but not a complete control. The article’s core finding is that authentication strength collapses if the surrounding identity lifecycle is not equally constrained.

Key questions

Q: What breaks when MFA is not native to the identity platform?

A: When MFA is not native to the identity platform, enforcement often becomes uneven across applications, user groups, and access paths. That inconsistency creates audit gaps and leaves privileged or remote sessions exposed to credential theft. Security teams then have to prove control effectiveness across multiple layers instead of one authoritative policy plane.

Q: Why do prompt bombing attacks still work against modern MFA deployments?

A: They work because repeated approval requests exploit fatigue, urgency and routine behaviour. The control is vulnerable when users are expected to make a security decision under pressure. Stronger methods, better alerting and tighter approval rules reduce that dependence on human judgement.

Q: How do security teams know whether their MFA programme is actually defensible?

A: They know it is defensible when they can prove enforcement across the access paths insurers and attackers both care about, especially remote access and privileged accounts. Evidence should include policy exports, sign-in logs, and coverage reports that reconcile exceptions. If the proof is fragmented, the control is likely weaker than the questionnaire suggests.

Q: How should teams handle access when MFA infrastructure is unavailable?

A: They should predefine the failure state before it happens, then test it. If a control outage causes the system to default to open access, that is a design defect, not resilience. High-assurance environments need offline validation or tightly governed local fallback paths, with clear ownership and review.

Technical breakdown

Why MFA prompt bombing works

Prompt bombing exploits human decision fatigue, not a cryptographic weakness in MFA. Attackers repeatedly trigger approval requests until a distracted or pressured user approves one. The control failure is behavioural and procedural: push-based approval assumes the recipient can reliably distinguish legitimate and malicious prompts in the moment. When that assumption breaks, MFA becomes an attention test rather than a strong authenticator.

Practical implication: reduce dependence on user judgment under pressure by tightening approval rules and monitoring repeated prompt patterns.

How weak MFA configuration opens bypass paths

MFA implementation quality matters as much as the factor type. Gaps in enrollment, fallback methods, exception handling and step-up policy create alternate paths that attackers can search for and abuse. This is why ‘MFA enabled’ is not the same as ‘MFA governed’. In practice, the bypass often comes from policy design, not from the factor itself, especially where inconsistent rules exist across applications or user groups.

Practical implication: review MFA policy exceptions, fallback methods and step-up coverage as part of control validation, not as one-time setup tasks.

Why fail-open identity architecture changes the attack surface

A fail-open design defaults to granting access when a dependent control is unavailable, such as when a cloud MFA service cannot be reached. That may be acceptable in some physical systems, but it is dangerous for digital access because unavailability becomes a bypass condition. The architectural issue is not uptime alone, but what the system chooses to do when it cannot complete authentication. That choice can turn resilience into exposure.

Practical implication: define and test what access should look like when MFA infrastructure is unreachable, including offline validation or local fallback paths.

Threat narrative

Attacker objective: The attacker’s objective is to gain authenticated access and then pivot through weak identity controls to reach internal systems and data.

1. Entry occurs through prompt bombing, weak MFA deployment or compromise of a third-party account that already has access to internal systems.
2. Credential access is achieved when the attacker exploits approval fatigue, exception handling or fail-open behaviour to get authenticated access without defeating the factor.
3. Escalation follows when the attacker moves through recovery, delegated administration or excessive entitlements that were outside the original login control.
4. Impact is data exfiltration or broader internal access after the identity lifecycle gaps have been used to extend initial access beyond the login event.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authentication does not fail in isolation. MFA bypass cases show that the real exposure sits in the controls around the factor: enrollment, recovery, exception handling, delegated access and third-party governance. When those paths are loose, the login screen becomes a narrow checkpoint on top of a weak identity programme. The practitioner lesson is that authentication assurance must be measured across the full access lifecycle, not at sign-in alone.

Prompt bombing is a governance failure as much as a user-training problem. Repeated approvals work because the environment teaches users to treat prompts as routine until one gets through. That means the control boundary includes alert fatigue, policy friction and the design of the approval experience. In other words, the programme is telling the user to decide under pressure when the system should already know the request is abnormal.

Fail-open behaviour is an assumption collapse for MFA architecture. Access review processes assume that authentication outcomes are explicit and enforceable; fail-open systems assume that availability can safely substitute for assurance. That assumption fails when the control loss itself becomes the path to entry. The implication is not merely to add resilience, but to rethink which failure states are tolerable for privileged access.

Identity lifecycle governance is where MFA programmes either hold or break. The article is right to push beyond login, because recovery, delegated administration and excessive entitlements often outlive the original authentication event. That makes lifecycle controls the real containment layer for MFA bypass risk. Practitioners should treat provisioning, recovery and offboarding as part of the same threat surface as the factor itself.

Authentication strength has to be paired with entitlement visibility. Even strong MFA cannot answer the basic governance questions of who has access, why they have it and whether that access is still justified. The article points to the deeper programme issue: organisations that can verify login but cannot explain access are still exposed. The operational conclusion is to align authentication controls with access governance and entitlement review.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Identity security has to move past the sign-in event. The article’s real contribution is not a new MFA tactic, but a reminder that access assurance lives across provisioning, recovery, delegation and entitlement review. Organisations that continue to optimise only the front door will keep leaving side doors unlocked.

MFA programme maturity is now defined by failure behaviour. If a system cannot answer what happens when the primary authentication dependency is unavailable, it has not been fully designed for adversarial conditions. That makes resilience planning part of identity governance, not just infrastructure availability.

What breaks first is the assumption that one strong control can carry the whole identity programme. MFA reduces risk, but only when paired with visibility into why access exists and how it changes over time. For practitioners, that means aligning authentication, lifecycle governance and entitlement monitoring into one operating model.

For practitioners

• Harden approval-based MFA flows Reduce reliance on push approvals by requiring stronger authentication methods for sensitive access and by flagging repeated or unusual prompt patterns for review.
• Audit MFA exceptions and fallback paths Review enrollment gaps, exception handling, alternate verification methods and step-up rules across applications so that bypass paths are visible and owned.
• Define failure behaviour for unreachable MFA services Document and test what access should happen when a cloud MFA dependency is unavailable, including offline validation or local fallback options for high-assurance systems.
• Extend governance beyond the login event Tie provisioning, recovery, delegated administration and entitlement reviews to the same control model so that access does not outlive the reason it was granted.
• Increase visibility into third-party access Inventory contractor and supplier accounts with internal reach, then verify that overprivileged or weakly monitored identities cannot be used as bypass paths.

Key takeaways

• Attackers often bypass MFA by targeting the identity processes around it, not by defeating the factor itself.
• The article shows that prompt bombing, weak configuration, third-party exposure and fail-open design all create bypass opportunities.
• The control that limits this risk is broader identity governance across recovery, delegation, entitlements and failure states.

Key terms

• MFA Bypass: MFA bypass is any technique that defeats the protection offered by multi-factor authentication without actually breaking the control itself. This includes prompt abuse, token theft, adversary-in-the-middle attacks, and weak reset or enrolment processes that let an attacker re-establish trust.
• Prompt Bombing: An attacker technique that floods a user with repeated MFA requests until one is approved out of confusion, fatigue, or annoyance. It works because the control depends on a human making a quick decision under pressure, rather than on a factor that cannot be socially engineered.
• Fail-open Authentication: An access design that grants entry when the normal verification service is unavailable. This can preserve availability, but it also means a service outage can become an unauthorised access path. In identity programmes, fail-open decisions must be treated as security architecture choices, not just reliability settings.
• Identity Lifecycle Governance: Identity lifecycle governance is the set of processes that create, change, review, rotate, and revoke access across human and non-human identities. It matters because access risk usually increases when lifecycle events are slow, incomplete, or disconnected from the systems that rely on them.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.