Why do credential stuffing attacks still work when 2FA is enabled?

Why This Matters for Security Teams

credential stuffing still succeeds because two-factor authentication changes the shape of the attack, not the attacker’s starting point. If an adversary already has a valid username and password pair, the remaining work is often to defeat weak recovery flows, exploit reused sessions, or trigger authentication fatigue. NIST’s NIST SP 800-63 Digital Identity Guidelines make clear that identity assurance depends on the full authentication journey, not a single gate.

That matters because many environments still treat 2FA as a finish line instead of one control in a larger chain. Attackers know where the seams are: password reset, SIM swap, OTP interception, device trust gaps, and legacy protocols that bypass interactive login entirely. NHIMG’s Guide to the Secret Sprawl Challenge shows how identity compromise often begins long before a login screen is touched, and the same lesson applies to human accounts that rely on brittle recovery paths. In practice, many security teams discover the weakness only after session tokens or recovery channels have already been abused, rather than through intentional testing.

How It Works in Practice

Credential stuffing is effective when attackers can pair leaked passwords with high-volume automation and then pivot around the second factor. The most common failure is not breaking the 2FA mechanism itself, but finding adjacent paths that remain trusted. That can include password reset emails, backup codes stored insecurely, mobile push approvals, “remember this device” cookies, or help desk flows that were designed for convenience rather than resistance.

Current guidance suggests defending the whole lifecycle instead of the login event alone. That includes enforcing unique passwords, rate limiting, anomaly detection, phishing-resistant MFA where possible, and hardening recovery channels to the same standard as primary authentication. The OWASP Non-Human Identity Top 10 is aimed at non-human identities, but the same principle applies here: if an identity can be impersonated through weak secrets or weak issuance paths, the front door is only one part of the compromise surface.

For teams looking at attacker behaviour more broadly, NHIMG’s 52 NHI Breaches Analysis is a useful reminder that exposed credentials are usually part of a wider trust failure, not a standalone event. The operational response should therefore combine credential hygiene, session protection, recovery flow review, and continuous monitoring for impossible travel, token replay, and abnormal MFA prompts. These controls tend to break down in consumer-scale environments with heavy account recovery demand because support workflows often get exempted from the same policy rigor as authentication.

Common Variations and Edge Cases

Tighter authentication often increases user friction and help desk load, requiring organisations to balance account protection against recovery success rates and support overhead. There is no universal standard for every environment yet, so the right answer depends on how the second factor is implemented and what the account can access.

Some 2FA methods are materially stronger than others. SMS OTP can be defeated through SIM swap or number-port abuse. Push-based approvals can be worn down through prompt bombing. Email-based recovery is only as strong as the mailbox security behind it. By contrast, phishing-resistant options such as FIDO2 security keys or passkeys raise the bar significantly because they bind authentication to the intended origin and device. In practice, CISA cyber threat advisories repeatedly emphasise reducing reliance on easily intercepted factors and hardening identity recovery as a core defensive step.

For high-value systems, the real edge case is not ordinary login abuse but session theft after successful authentication. Once a token is issued, 2FA may no longer be in the path. That is why OWASP NHI Top 10 and related identity guidance both point toward short-lived trust, strong session binding, and continuous risk evaluation. Controls are strongest when the authentication factor, the recovery path, and the active session are all governed together.

Related resources from NHI Mgmt Group

• Why do MFA fatigue attacks still work when MFA is already deployed?
• Why do adversary-in-the-middle attacks still work when MFA is enabled?
• How can organizations counter AI-driven cyber attacks?
• Why do still-valid secrets matter after public disclosure?