Topic starter
07/03/2026 12:59 am
TL;DR: Password-based MFA still leaves attackers room to phish, intercept one-time codes, and exploit prompt bombing because the password and second factors remain vulnerable, according to Beyond Identity. The security case for passwordless, phishing-resistant authentication is now operational, not theoretical, for IAM and NHI teams.
Editorial analysis by NHI Mgmt Group, based on content published by Beyond Identity: “Password-Based MFA Vulnerabilities”.
Key questions
Q: What breaks when MFA is configured with weak, phishable factors?
A: Weak factors such as SMS codes, OTP apps, or push-based approvals can satisfy a policy checkbox while still leaving the environment open to phishing, man-in-the-middle, and push bombing attacks.
Q: Why do phishable MFA factors still create account takeover risk?
A: Because the attacker does not need to defeat authentication in the abstract, only to exploit the weakest part of the factor chain.
Q: What are the warning signs that MFA prompt bombing is succeeding?
A: Look for repeated approval requests, users reporting notification fatigue, unusual device registrations after authentication, and accounts that see many failed or denied prompts before one success.
Practitioner guidance
- Replace phishable second factors Remove SMS, email OTP, and approval-only push flows from access paths that protect sensitive data or privileged functions.
- Prioritise passwordless for high-risk access Move sensitive workforce and privileged accounts to cryptographic, device-bound authentication where the login flow does not depend on a transferable secret.
- Harden authentication against fatigue attacks Reduce repeated prompts, investigate unusual approval bursts, and treat notification fatigue as an authentication design issue rather than a training issue.
Bottom line: Password-based MFA reduces risk but still leaves room for phishing, interception, and prompt abuse when the factors themselves are weak.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:05 pm
Password-based MFA is a risk reducer, not a trust reset: It lowers the odds of opportunistic compromise, but it still preserves the password as a weak anchor and often adds a second factor that can be phished or intercepted. That means the control reduces attacker cost without removing the attacker path. For identity programmes, the real question is whether the factor set resists modern access attacks or only satisfies a control checklist.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations replace MFA with passwordless authentication?
A: Organisations should not treat this as a simple replacement question. MFA is still useful where passwordless is not yet available, but passwordless raises the security baseline by removing the password as the primary failure point. The right path is to use MFA as a bridge and passwordless as the destination.
👉 Read our full editorial: Password-based MFA weaknesses expose the limits of phishable factors